Ransomware Group 0APT’s Early Claims Met with Skepticism
A newly emerged ransomware-as-a-service (RaaS) operation calling itself 0APT has quickly drawn attention – and considerable doubt – after claiming nearly 200 victims in a remarkably short period. While the group’s rapid publication of alleged breaches initially raised alarms, cybersecurity researchers are increasingly confident that 0APT’s claims are largely fabricated, representing a bluff intended to inflate its reputation. The group’s activity, first observed in January 2026, highlights the evolving tactics employed by ransomware actors and the challenges in discerning genuine threats from deceptive displays.
According to data analyzed by the Halcyon Ransomware Research Center as of February 5, 2026, the majority of the purported victims are located in the United States, followed by the United Kingdom and India. This geographic distribution mirrors the general targeting patterns of many ransomware groups, which prioritize countries with robust economies and potentially higher ransom payment capabilities. However, the sheer volume of claimed victims within such a compressed timeframe immediately raised red flags among security analysts.
The practice of publishing victim lists is common among ransomware groups, often used as a tactic to pressure victims into paying a ransom. The Cl0p operation, notorious for exploiting vulnerabilities like the MOVEit Transfer vulnerability in 2023, is known for its mass exploitation and subsequent public disclosure of compromised organizations, as reported by ComputerWeekly. However, the speed and scale of 0APT’s disclosures are atypical, prompting a deeper investigation into the validity of its claims.
Doubts Over Data Authenticity and Victim Credibility
A detailed analysis conducted by researchers at Cyderes, a cybersecurity firm, revealed significant inconsistencies in 0APT’s claims. Rahul Ramesh and Reegun Jayapaul of the Cyderes Howler Cell team noted that claiming approximately 200 victims in a short window without providing supporting evidence is “operationally inconsistent with observed ransomware group behavior.” Mature ransomware operations typically stagger disclosures and offer proof of compromise – such as sample data – to bolster their negotiating position. 0APT’s rapid and unsupported announcements suggest a different strategy, one focused on creating an illusion of widespread impact.
Further scrutiny of 0APT’s leak site revealed additional concerns. While the site advertises downloadable file trees purportedly containing stolen data, researchers found that the actual files, when downloadable, were often significantly larger than expected and appeared to be filled with random junk disguised as compressed archives (.zip or .pdf files). Critically, the leak site lacked screenshots of compromised data, a standard practice in the ransomware underground used to demonstrate the validity of the breach. This absence further eroded confidence in 0APT’s claims.
Perhaps most damningly, investigations by GuidePoint Security’s Research and Intelligence (GRIT) team uncovered evidence that many of the alleged victims may not even exist. Jason Baker of GRIT shared screengrabs highlighting “Metropolis City Municipal” as a victim, claiming 0APT had stolen city planning documents, vendor payments, and internal memos. However, Metropolis, Illinois, is a small town with a population of approximately 7,000 residents and there is no public record of a ransomware attack impacting the municipality. The use of the name “Metropolis” is widely believed to be a reference to the DC Comics Superman franchise, and the entry has since been removed from the leak site.
While some legitimate organizations were listed among 0APT’s claimed victims – including Germany’s BASF, Taiwan’s Foxconn, the UK’s GlaxoSmithKline, Japan’s Hitachi, South Korea’s Hyundai Heavy Industries, and France’s TotalEnergies – Baker reported that at least two of these organizations confirmed they had experienced no intrusion, found no ransom notes, and had not been contacted by the cybercriminals. “The victims claimed by 0APT are a blend of wholly fabricated generic company names and recognizable organizations which threat actors have not breached,” Baker wrote. “GRIT has observed no evidence that these victims were impacted by a threat actor associated with 0APT, including through first-hand reporting.”
Motives Behind the Deception
According to GRIT, 0APT’s deceptive tactics likely serve multiple purposes. These include attempting to extort uninformed victims, re-extorting victims previously targeted by other ransomware groups, defrauding potential affiliates, or simply generating interest in a nascent RaaS operation. The RaaS model allows ransomware developers to lease their malware to affiliates, who then carry out attacks and share the profits. Building a reputation, even a false one, can be crucial for attracting affiliates and establishing a foothold in the competitive ransomware landscape.
Despite the initial farcical nature of its debut, researchers emphasize that 0APT is not entirely without technical capability. Ramesh and Jayapaul of Cyderes confirmed that the group is operating an active RaaS platform with functional malicious payloads and a working affiliate model. “The early bluff may have been intended to quickly build a reputation and attract a larger pool of partners, but it likely had the opposite effect, damaging credibility rather than strengthening it,” they stated. However, they also acknowledged that the group is continuing to develop its infrastructure and actively seeking to establish a legitimate cybercriminal operation.
The Broader Ransomware Threat Landscape
The emergence of 0APT underscores the ongoing evolution of the ransomware threat landscape. The Halcyon Ransomware Research Center tracks the activities of numerous ransomware groups, noting a significant increase in claimed victims globally. In 2025, the center reported 5,414 claimed victims, and the average cost of a breach reached $4,880,000. Manufacturing, healthcare, education, business services, and construction were identified as the most targeted sectors in the third quarter of 2025. Akira, Lynx, Medusa, INC Ransom, and Qilin were identified as the most active ransomware groups during that period.
The proliferation of RaaS models continues to lower the barrier to entry for aspiring cybercriminals, enabling individuals with limited technical expertise to launch ransomware attacks. This trend, coupled with the increasing sophistication of ransomware tactics, poses a significant challenge to organizations of all sizes. Effective cybersecurity strategies require a multi-layered approach, including robust endpoint protection, regular data backups, employee training, and proactive threat intelligence.
Looking Ahead
While 0APT’s initial foray into the ransomware world was marked by deception, the group’s continued development of its infrastructure suggests it may pose a more credible threat in the future. Security researchers will continue to monitor 0APT’s activities closely, analyzing its tactics, techniques, and procedures (TTPs) to identify potential vulnerabilities and develop effective mitigation strategies. The Halcyon Ransomware Research Center, led by Cynthia Kaiser, Senior Vice President and former Deputy Assistant Director of the FBI’s Cyber Division, is actively seeking partnerships with industry professionals and research organizations to enhance intelligence collaboration and strengthen the global response to ransomware threats.
The next significant development to watch will be the release of Halcyon’s Q4 2025 ransomware threat report, expected in early March 2026, which will provide a comprehensive overview of the latest trends and emerging threats in the ransomware landscape. Staying informed about these developments is crucial for organizations seeking to protect themselves from the ever-evolving threat of ransomware.
What are your thoughts on the tactics employed by 0APT? Share your insights and experiences in the comments below, and don’t forget to share this article with your network to raise awareness about the evolving ransomware threat.