Reading ransomware claims without amplifying them

Ransomware coverage gets sloppy in a predictable way. A leak site names a victim, a screenshot circulates, and the write-up says the organization was breached. Sometimes that is true. Often the only source is the criminals.

ThreatWire will treat those posts as claims. The record can say that a group claimed a victim. It will not say the claim is confirmed intrusion, confirmed data theft, or confirmed encryption unless a better source exists: the victim, a government notice, or reporting that distinguishes what was checked from what was repeated.

The same rule applies to vulnerability status. Known ransomware use in the CISA KEV catalog is a reason to mark Active Exploitation. A gang's blog post naming a CVE is not, by itself, a reason to mark an exploit available.

When this desk writes a campaign note, it will carry three lines even when the answer is unknown: what was claimed, what is confirmed, and what we are not saying. Empty confirmation stays empty.