A new ransomware collective known as Dark Project is making waves in the cybercrime world by offering hackers a lucrative 80% commission on successful attacks. This enticing offer is part of their strategy to lure criminals into their network, where they provide a platform designed to manage extortion activities.
Emergence and Methodology
Dark Project was first identified in June 2026, and it has quickly gained notoriety for its aggressive approach. The group combines data theft, file encryption, and the threat of leaking information to coerce organizations into paying ransoms. According to reports, the group has targeted 38 organizations across eight countries, with the majority, 30 to be precise, located in the United States.
Industries such as manufacturing, healthcare, and construction appear to be primary targets. However, it’s important to note that these figures are based on intelligence and public leak-site records, not all of which have been independently verified as compromises.
Recruitment and Operational Structure
Research from cybersecurity firm Gurucul has shed light on the Dark Project’s operations, highlighting their recruitment tactics, infrastructure, and attack methodologies. The ransomware group advertises an affiliate program where partners receive 80% of the proceeds, while the group retains 20% for infrastructure and support services. This model is reminiscent of established revenue-sharing practices used by other ransomware groups, though payment fulfillment remains unverified.
Potential affiliates must go through a four-stage process: application, vetting and onboarding, deployment, and commission settlement. Communication is conducted via Tox, and once approved, partners are given unique identifiers and access to the platform to execute attacks. The group manages communications and negotiations with victims, promising commission payouts within 24 hours of a completed attack.
Infrastructure and Attack Techniques
The infrastructure employed by Dark Project includes a Tor-hosted operations dashboard and agents in EXE and BIN formats. These agents contain identifiers to track affiliate activities. Despite these claims, Gurucul has not independently verified these capabilities through malware analysis.
Dark Project advocates for Bitcoin as the preferred payment method, although specific wallet details or transaction verifications are absent in reports. August 2026 saw a peak in victim disclosures, with fluctuations in subsequent months. These dates correlate to publication activities rather than confirmed intrusion timelines.
Security Risks and Recommendations
Gurucul’s analysis indicates that Dark Project’s initial access is often gained via phishing, compromised Remote Desktop Protocol services, stolen credentials, and VPN access obtained through infostealer logs or brokers. The group primarily targets Windows environments and employs a double-extortion strategy, threatening to release sensitive information if ransoms are not paid. This approach highlights the dual risk of operational disruption and data exposure.
The report aligns Dark Project’s activities with various techniques, including abuse of legitimate accounts, data exfiltration, encryption, and system recovery inhibition. However, not all vulnerabilities listed have been confirmed as entry points. Organizations are advised to prioritize patching, enforce stricter access controls, and bolster monitoring and backup security.
Finally, manufacturing, healthcare, and construction sectors should be particularly vigilant, as these industries have been frequently targeted. Implementing comprehensive security measures can help mitigate risks even if the attack patterns vary among affiliates.
