A new ransomware collective dubbed Dark Project has emerged, offering criminal partners an unusually high 80% commission for assisting in cyberattacks. While the group’s modus operandi echoes established affiliate ransomware models, its size, tactics, and leverage of public pressure have already raised alarms. The threat intelligence firm Gurucul first flagged Dark Project in June 2026, noting its dual-pronged strategy: data theft and file encryption followed by threats of public leaks to compel ransom payments.
How Dark Project Operates
Dark Project runs an affiliate program structured in four phases: application, vetting and onboarding, deployment, and commission settlement. Prospective partners connect via the encrypted messenger Tox. Upon acceptance, affiliates receive a unique identifier tag, access to an operations dashboard (hosted on Tor), payloads in EXE or BIN formats, and partner instructions. The group claims it will handle all ransom negotiations and communications with victims, promising commission payments within 24 hours of a successful ransom agreement.
Technically, recruitment and infrastructure mirror longtime ransomware-as-a-service networks. But crucially, Gurucul’s report notes that much of Dark Project’s promotional materials—including agent identifiers and negotiation promises—have not yet been verified through malware analysis or blockchain transaction evidence.
Victimology, Tactics, and Defensive Steps
Victim disclosures attributed to Dark Project cover 38 organizations in eight countries, with the United States alone accounting for 30 of those listings. Among affected sectors, manufacturing leads with 12 named victims, followed by healthcare with seven, and construction with four. These figures arise from threat intelligence leak sites and threat actor disclosures—not confirmed breaches—and reflect publicly published data, not verified compromise dates.
Dark Project’s playbook includes a range of intrusion techniques: phishing, exposed Remote Desktop Protocols, compromised credentials, VPN access via brokers or infostealers. Once access is gained, the group deploys dual threats—stealing sensitive info prior to encrypting systems—and threatens publication via a Tor-based leak site if ransom demands are not met. Common vectors listed include Windows environments, valid account abuse, and the use of SMB and Windows Management Instrumentation tools. While the group lists several associated vulnerabilities, none are definitively confirmed as exploited entry points.
Gurucul’s recommendations to potential targets include patching known vulnerabilities promptly, strengthening access controls (especially on RDP, VPNs), monitoring for suspicious behavior, and maintaining secure, isolated backups. Even if a victim restores encrypted files, losing control of stolen data remains a risk.
Gray Areas: What Still Needs Confirmation
Although Dark Project promises high commissions and full service—negotiations, victim communication, payout settlements—there’s no proven record yet of these claims being consistently fulfilled. The report provides no bitcoin addresses, no verified wallet activity, and no publishable samples of the malware agents tied to specific affiliates. Indicators of compromise (IoCs) such as SHA256 hashes or attacker domains are either missing or obfuscated. Security analysts remain cautious: ideal threat intel must distinguish between marketed capabilities and real, demonstrable tools.
This group’s peak public disclosure occurred in August 2026, when 20 victims were listed. Four listed cases appeared in June, none in July, then five in each of September and October, plus four more in early November (as of the reporting date). These numbers reflect the frequency of leak site postings—not necessarily when attacks happened or were discovered.
For organizations in manufacturing, healthcare, and construction—industries already holding sensitive data—this poses a heightened danger. A successful attack not only disrupts operations but potentially exposes private data, harming reputation and compliance.
Dark Project combines the recruitment rigor of ransomware-as-a-service groups with public threat tactics as leverage. If the group follows through on its marketing, its affiliates could force significant pressure on victims. Defensive teams need to treat this as more than just distributed ransomware: the data-extortion squeeze raises the stakes. Observing which affiliates actually deliver on payouts, obtaining concrete IoCs, and tracking confirmed exploit methods will be key to understanding whether Dark Project becomes a lasting name in ransomware—or just another group good at marketing threats.
