More attackers trying to sabotage incident response tactics