Ransomware gangs and PR stunts: Why LockBit faked a ransomware attack against Mandiant

This report examines a LockBit public-relations stunt following Mandiant's attribution that linked a financially motivated cluster (UNC2165) associated with the sanctioned group Evil Corp to LockBit activity; LockBit published response files on its leak site to dispute the link and distance itself from Evil Corp, and the analysis highlights the legal and operational implications for victims and the broader ransomware ecosystem.