Re-Up Scams — The Second-Order Trick That Catches Regulars

There’s a particular kind of failure that only becomes visible in hindsight. It happens after you’ve done everything right for two years: finally found a vendor with steady product, navigated the PGP dance flawlessly, never clicked a phishing link, and even weathered a market migration without losing a coin. Then, one Tuesday morning, you log in to a familiar storefront and see a notice about “maintenance,” or worse, you get a message from a username you thought you knew, asking you to finalize early on a routine reship. That’s not a hack. That’s the second-order trick-the re-up scam-and it’s engineered specifically for regulars who have stopped double-checking their own habits.

The darker corners of the cybercrime ecosystem have always had a problem with repeat customers. In the ransomware world, researchers have spent significant time scraping leak sites to understand why the same victim shows up under two different gang banners. A recent analysis of nearly 14,000 victim listings scraped between July 2024 and June 2026 found 213 organisations named by more than one group-roughly one in sixty. At first glance, this looks like terrible luck. But digging into the data reveals a pattern that translates directly to the market scene: not everything that looks like a second attack is one. Sometimes it’s the same stolen data being squeezed for a second payment, wearing a different mask.

This is the core mechanics of the re-up scam. It doesn’t target newbies who are still fumbling with tails. It goes after the demographic that has already proven they have money and a willingness to move it-the regulars who have a standing relationship with a vendor or a specific market’s internal messaging system. The con is rarely a single move. It’s a layered campaign designed to exploit the trust that’s been built up over months of successful transactions.

The Anatomy of the Double-Dip

To understand how this works on a market, you have to look at how the same technique plays out in adjacent fields. The threat intelligence community has a specific name for the pattern where a victim gets hit, pays, and then gets hit again by a group that claims to be unrelated-the “same victim, different gang” problem. The honest answer, after sifting through the data, is that genuine coincidental double hits are rare. In the ransomware dataset, after stripping out rebrands, copycats, fabricated claims, and shared-affiliate cases, researchers were left with 132 companies with no obvious explanation-an upper bound, not a confirmed count. But even that number is misleading because a significant chunk of the apparent double-hits are actually orchestrated by the same operators.

Consider the case study of a group calling itself Scattered Lapsus$ Hunters. In October 2025, they posted an enormous batch of household names-Toyota, FedEx, Disney/Hulu, and dozens more-all within a few hours. Three to six months later, a handful of those same companies reappeared under the banners of ShinyHunters or Coinbase Cartel. On the surface, it looks like two separate gangs had independent success against the same corporation. In reality, threat intelligence assessments describe these groups as drawing on the same affiliate pool. The pattern is specific: collect a ransom, then come back under a different name demanding more, often over data the victim thought had already been dealt with. When Cisco appears under ShinyHunters roughly six months after showing up in the Scattered Lapsus$ Hunters mega-post, that isn’t a second breach. It’s the same stolen data being squeezed for a second payment.

Now translate that to a market context. You’re a vendor on a platform that just went through an exit scam or a seizure. You’ve got a list of customers who have bought from you before. You know their usernames, their PGP keys, and their tolerance for risk. You spin up a new storefront on a different market, or you simply clone your old vendor profile on a phishing URL that looks like the original market’s mirror. You message your old regulars: “New address, same quality, here’s a discount for the hassle.” The regulars, who have been burned by the market collapse, are relieved to find their vendor. They don’t check the PGP key against an old message. They don’t verify the mirror URL against a trusted aggregator. They just send coin to the new address and wait for a package that never arrives.

The Fabricated Volume Play

The second-order trick doesn’t always require a real prior relationship. Sometimes it works on the illusion of legitimacy. There’s a fascinating case from the ransomware world that serves as a perfect warning for market users. In late January 2026, an outfit calling itself 0APT appeared from nowhere and, within about a week, claimed more than 200 victims. That kind of volume normally takes an established group years to build up. It set off alarm bells immediately. Researchers at GuidePoint, Intel 471, and S-RM independently reached the same conclusion: the list was largely fabricated, mixing invented company names with real, recognisable ones. One invented victim, “Metropolis City Municipal,” turned out to be lifted straight from the fictional city in the DC Comics universe. When researchers tried to download the “stolen data,” the files were masked to look hundreds of gigabytes in size and never actually finished downloading.

On a market, this translates to the fake vendor who creates a profile, posts a few glowing reviews using sockpuppet accounts, and then starts messaging buyers who have just lost their regular plug. They’re counting on the chaos of a market migration to make you stop verifying. They’re counting on the fact that you’re desperate to restock and that you’ve already let your guard down because you’re operating in an environment where active security measures are ironically the easiest thing to skip.

The Affiliate Trap

There’s another layer to this that’s even more insidious. It involves the affiliate structures that link different criminal operations. A recent analysis of scam campaigns-this time outside the market sphere but painfully relevant-showed how operators “impersonate trusted brands” to push consumers toward unrelated gambling sites. The scammers leverage the trust people place in familiar logos, running ads on social media that claim a bank or retailer has launched a slots game. Clicking the ad takes the victim to a landing page dressed up to look like an official app store listing. From there, users are guided to install what looks like an app but is actually a Progressive Web App-a browser shortcut disguised as a native application. Once opened, that shortcut quietly loads an unrelated gambling site through affiliate tracking links, generating a payout for whoever ran the ad. Affiliate platforms reportedly pay between $50 and $350 for every player who signs up and deposits money.

Apply this logic to darknet markets. The “affiliates” in the scam ecosystem are the same across industries. A market admin doesn’t have to run an exit scam directly. They can sell access to a network of “reship partners” who are actually just phishing operations. When a regular buyer contacts their usual vendor about a reship, they get redirected to a “new secure channel” that is nothing more than a data-harvesting site dressed up with the vendor’s logos and style. The buyer doesn’t even lose money on the product-they lose it on the escrow account takeover or the PGP key compromise that follows.

The Countdown Clock and the Rebrand

One of the most telling details from the ransomware data is the countdown clock-the leak site timer ticking down next to a victim’s logo. It’s a pressure tool. But for markets, the pressure tool is time itself. When a market goes down or a vendor disappears, there’s a window of opportunity for scammers to step in. This is precisely why the timing of the re-up scam matters so much. It flourishes during periods of ecosystem reshuffling-exactly the kind of periods when legitimate exit scam warnings are circulating and users are anxious about which mirrors are real.

The 0APT case also exposed the “hoax gang” phenomenon, where a brand-new operator fabricates an entire victim list to look established. In April 2026, a rival outfit called KryBit hacked 0APT itself and published its internal logs, confirming the entire claim was invented. For market users, the lesson is stark: a vendor with a high sales count and a long history on a brand-new address may be a phantom. The fabricated volume play is not just about looking credible to new buyers-it’s about convincing regulars that their old vendor has simply moved shop. When you see a familiar name on a fresh market mirror, your first instinct should be to check whether the PGP key actually matches your saved copy from the last successful order. If you don’t have a saved copy, you’re already vulnerable.

Practical Verification Steps

So how do you avoid becoming a statistic? The first rule is to treat every single contact from a vendor after a market outage as a potential phishing attempt, regardless of how legitimate it looks. Verify the market URL independently, never through a link sent in a message. Check the vendor’s PGP key against a previously recorded one. If you don’t have one recorded, you weren’t as regular as you thought.

The second rule concerns the escrow mechanism. Legitimate vendors do not ask for FE (finalize early) on a transaction after a market disruption. Any request to move coin directly or to “trust me just this once while we rebuild” is a flashing red light. The data is clear: even in the ransomware world, where the stakes are corporate survival, the double-dip succeeds because victims are so relieved to have resolved the problem the first time that they let their guard down. The same psychological dynamic applies to a buyer who just lost a package to a market seizure and is eager to get back on track.

Finally, look for the 0APT pattern in your own threat model. If a vendor you’ve never heard of suddenly appears with a massive number of sales and an inventory that looks too good to be true, they’re either running a fabricated volume play or they’re a front for an operation that will exit scam on the next big order. The same way researchers found that roughly two-thirds of the unexplained double-hit victims were American companies in construction and manufacturing-sectors running older, less segmented infrastructure-the market regulars who fall for re-up scams are usually those who have stopped segmenting their own opsec. They reuse usernames across markets, they reuse PGP keys that have been compromised, and they fail to maintain a clean record of who they’ve actually transacted with.

The double-dip works because it exploits the gap between what you know and what you think you know. The vendor you were chatting with isn’t necessarily the person who compromised that vendor’s account. The market mirror you’re using isn’t necessarily the one you bookmarked six months ago. The second-order trick is not about catching newbies-it’s about catching the people who have grown so comfortable in their routine that they’ve stopped doing the basic verification that kept them safe in the first place.

The data from the ransomware world tells us that roughly one in sixty victims will be listed by a second group. But that number is almost certainly an undercount because so many double-hits go undetected, obscured by rebrands and shared affiliates. On markets, the equivalent number is likely higher, precisely because the barrier to entry for a scammer is lower. All they need is a stolen PGP key and a convincing story about a market migration. Everything else-the trust, the history, the relationship-is already in place, waiting to be exploited.