cyber.hendryadrian.com
Security News · bitsight.com

BitSight Warns Threat Actors Use Impersonation and Conflicting Claims to Obscure Attribution

· Original article ↗

Summary

BitSight describes threat actors using impersonation, denials and blame-shifting to confuse attribution. The article explains the risks for incident response and recommends verifying claims against preserved communications and technical evidence.

Key points

  • BitSight tracked disputes over threat-actor identities and attack claims across Telegram channels and dark web forums between September 2025 and August 2026.
  • Examples included channels using ShinyHunters and Scattered LAPSUS$ Hunters branding that denied attacks, blamed other actors and disputed which accounts were genuine.
  • A CARDINAL-branded channel claimed access to military-related systems while denying that it had hacked or leaked information; BitSight said it did not independently verify the claims.
  • The article notes that impersonation can also support scams, and that familiar branding or a ransom note alone does not establish who carried out an intrusion.
  • Misattribution may lead organizations to choose the wrong response, such as treating possible state-backed access as ordinary extortion or overlooking persistent access.
  • Defenders are advised to preserve full conversations and timestamps, trace claims to their original sources, track identity changes, and prioritize technical evidence over branding or writing style.

Article Details

Event Type
Threat intelligence analysis of cyber threat actor impersonation, disputed attack claims, and deliberate attribution manipulation.
Impact
Impersonation and conflicting claims can misdirect incident response, obscure whether an intrusion is criminal or state-backed, undermine trust in ransom negotiations, and delay law-enforcement or geopolitical decisions. Bitsight describes these patterns based on activity tracked from September 2025 to August 2026; several actor claims cited in the article were not independently verified.

Threat Actors

AkiraNamed ransomware group whose data leak site warned that impersonators had copied its brand.CARDINALA Telegram channel using this name claimed access to sensitive systems and disruption of a military cargo flight; Bitsight did not independently verify the claims.RansomHubNamed as an example of a group whose attack claim could be disputed by another channel claiming to represent it.Scattered SpiderNamed ransomware-group identity whose branding the article says could be impersonated to obscure an attack's attribution.ShinyHuntersIts branding was used by channels making conflicting attack claims and warning about impersonators; the article does not independently verify those claims.

Vendors

CISAA 2024 joint advisory from the FBI, CISA, and the Department of Defense Cyber Crime Center described Iranian state-sponsored actors working directly with ransomware affiliates. According to the advisory, the actorsDepartment of Defense Cyber Crime CenterA 2024 joint advisory from the FBI, CISA, and the Department of Defense Cyber Crime Center described Iranian state-sponsored actors working directly with ransomware affiliates. According to the advisory, the actorsFBIA 2024 joint advisory from the FBI, CISA, and the Department of Defense Cyber Crime Center described Iranian state-sponsored actors working directly with ransomware affiliates. According to the advisory, the actors

Products

TailsAnd what if the attacker uses Tails, Tor, proxies, hacked infrastructure, and burner accounts to make connecting the dots nearly impossible?

Tools

TorAnd what if the attacker uses Tails, Tor, proxies, hacked infrastructure, and burner accounts to make connecting the dots nearly impossible?

Countries

Chinacome back to the same countries. According to the Council on Foreign Relations Cyber Operations Tracker, China, Russia, Iran, and North Korea sponsored 77% of the suspected state-backed operations in its dataset.Iranthe same countries. According to the Council on Foreign Relations Cyber Operations Tracker, China, Russia, Iran, and North Korea sponsored 77% of the suspected state-backed operations in its dataset. There's no perfectIsraelthe ransomware-enabling activity. The FBI assessed that the goal was aimed at undermining confidence in Israel-based cyber-infrastructure.North KoreaAccording to the Council on Foreign Relations Cyber Operations Tracker, China, Russia, Iran, and North Korea sponsored 77% of the suspected state-backed operations in its dataset. There's no perfect attribution,Russiato the same countries. According to the Council on Foreign Relations Cyber Operations Tracker, China, Russia, Iran, and North Korea sponsored 77% of the suspected state-backed operations in its dataset. There's no

Related Articles