Dark Project Ransomware-as-a-Service Offers Affiliates 80% of Ransoms — 38 Alleged Victims in Eight Countries, Half in Manufacturing and Healthcare

Medium · 2026-11-07 · By H.A

Dark Project, a double-extortion ransomware-as-a-service operation first seen in June 2026, is recruiting affiliates with an 80/20 split and has listed 38 alleged victims, 30 of them in the United States.

Overview

Security researchers have published a threat actor profile of Dark Project, a ransomware-as-a-service (RaaS) operation first observed in June 2026 that is recruiting affiliates with an advertised 80% share of ransom proceeds, the operators keeping 20% for "platform services and reporting". The group runs a double-extortion model against Windows environments and publishes alleged victims on a Tor leak site.

At the time of the snapshot the leak site listed 38 alleged victims in eight countries (a public tracker shows 40). Thirty are in the United States, two in the UK, and one each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada. Manufacturing (12) and healthcare (7) account for half the listings, followed by construction (4), with retail, transportation, financial services, professional services and entertainment also present.

All victim figures are the group's own claims, not confirmed breaches, and listing dates are publication dates, not intrusion dates.

The Campaign

Dark Project presents itself as a full-service platform:

• Affiliate recruitment through Tox, followed by vetting, onboarding and assignment of a unique partner identifier.
• Tooling for affiliates: a Tor-hosted operations dashboard, ransomware "agents" supplied in EXE and BIN formats, and social-engineering tools.
• Partner identifiers embedded in the agents, reportedly linking each deployment to a specific affiliate.
• Division of labour: affiliates break in and deploy; the core operators handle victim communication and ransom negotiation.
• Payment in Bitcoin, with victims told to buy cryptocurrency and send it to an administrator-provided wallet. The group also promises affiliates commission within 24 hours of a completed engagement — an unverified claim.

Timeline

Leak-site listings by month:

• June 2026: 4 (first observed)
• July 2026: 0
• August 2026: 20 — the peak
• September 2026: 5
• October 2026: 5
• November 2026 (to 6 Nov): 4, including three posted on 3 November and one on 4 November

The August spike followed by a steady trickle is typical of a new RaaS: an initial burst from early affiliates, then a recruiting push — which the 80% offer appears to be — to scale up.

Tradecraft

Researchers describe familiar, low-sophistication entry points, which is precisely why they work:

• Initial access: phishing; exposed Remote Desktop Protocol services; compromised credentials; and VPN access bought from initial access brokers or pulled from infostealer logs.
• Execution and lateral movement: abuse of valid accounts, Windows Management Instrumentation (WMI), RDP and SMB.
• Impact: data exfiltration before encryption, file encryption, and attempts to inhibit recovery (typically deleting shadow copies and backups).
• Extortion: threat of publication on the Tor leak site, used as leverage during negotiations.

No encryption algorithm, file extension, ransom note text or malware analysis has been published, and the report lists associated vulnerabilities without confirming them as entry points.

Indicators of Compromise

No file hashes, domains, IP addresses, Tox identifiers or wallet addresses have been published for Dark Project at this time. Detection therefore has to rely on behaviour.

Detection

Focus on the behaviours common to this kind of affiliate intrusion:

• Remote access: RDP or VPN logins from new countries, hosting providers or at unusual hours; successful logins after bursts of failures; VPN sessions with no matching MFA event.
• Lateral movement: remote WMI process creation (wmiprvse.exe spawning cmd.exe or powershell.exe), new services created over SMB, and one account authenticating to many hosts in a short window.
• Recovery inhibition: commands that delete shadow copies or disable recovery, for example:

vssadmin delete shadows
wmic shadowcopy delete
bcdedit /set {default} recoveryenabled no
wbadmin delete catalog

• Exfiltration: large outbound transfers to cloud storage or unknown hosts, and archiving tools run on file servers.
• Payloads: unsigned EXE/BIN files dropped into C:\ProgramData, C:\Users\Public or temp folders and pushed to many hosts at once.

Recommended Actions

1. Remove RDP from the internet and put remote access behind a VPN or zero-trust gateway that enforces phishing-resistant MFA.
2. Audit VPN accounts: disable stale users, enforce MFA on every authentication path, and reset credentials for any user whose device has shown infostealer activity.
3. Monitor infostealer exposure of corporate credentials and act on it quickly — access brokers sell these logs within days.
4. Restrict WMI and SMB between workstations, and limit administrative logins with tiered admin accounts and LAPS.
5. Protect backups: keep offline or immutable copies, separate backup credentials from the domain, and test restores.
6. Plan for data theft: restoring files does not stop stolen data from being published, so include legal, notification and communications steps in the ransomware playbook.
7. Manufacturing and healthcare organisations in particular should review OT/clinical network segmentation from IT.

Analyst Assessment

Dark Project is a small but growing operation whose main asset is its offer: an 80/20 split is at the generous end of the RaaS market and is designed to attract experienced affiliates away from established brands. Its claimed tooling and access methods are not novel, so standard ransomware hardening is effective against it. The concentration of U.S. manufacturing and healthcare victims may reflect opportunism rather than deliberate targeting. We rate the threat Medium today, with a clear risk of growth if the recruitment drive succeeds. Expect technical indicators to emerge as incident responders encounter the payloads.