New Dark Project Ransomware Group Offers Hackers 80% Commission to Expand Cyberattacks

A ransomware group called Dark Project is recruiting criminal partners with an offer of 80% of proceeds from successful attacks, pairing generous commissions with a platform for managing extortion.

First observed in June 2026, the financially motivated operation combines data theft, file encryption, and public leak threats to pressure organizations into paying.

The group’s published victim records cover 38 organizations across eight countries, with the United States accounting for 30 listings.

Manufacturing, healthcare, and construction feature prominently. However, these figures describe organizations named in threat intelligence and leak-site records, not independently verified compromises or a complete measure of the group’s activity.

Researchers from Gurucul identified Dark Project’s ransomware operation in their threat actor profile, documenting its recruitment process, infrastructure, and reported attack methods.

Their findings describe an emerging operation that uses the language of legitimate security services to advertise tools and partner support for ransomware activity.

New Dark Project Ransomware Group

Dark Project advertises a partner program under which affiliates receive 80% of proceeds while its operators retain 20% for platform services and reporting.

The offer resembles established ransomware affiliate revenue models used by other criminal groups, although the advertised terms do not prove that partners receive payments as promised.

Recruitment follows four stages: application, vetting and onboarding, deployment, and commission settlement. Applicants contact the group through Tox.

Approved partners reportedly receive a unique identifier, platform access, and operational instructions before deploying payloads against organizations.

Dark Project claims to manage victim communication and ransom negotiations, promising commission payments within 24 hours of a completed engagement.

The advertised infrastructure includes a Tor-hosted operations dashboard, agents supplied in EXE and BIN formats, and a social-engineering simulation suite.

Agents reportedly contain partner identifiers that allow activity to be linked to individual affiliates. These are platform claims documented by Gurucul, rather than capabilities independently demonstrated through published malware analysis.

Separating payload deployment from negotiations gives affiliates fewer operational tasks to manage. Comparable affiliate management platform features have appeared in Lynx ransomware operations, where partners can manage victim profiles and leak schedules.

Dark Project also promotes Bitcoin payments, but the supplied report provides no wallet addresses or transaction evidence confirming settlements.

Victim disclosures peaked in August 2026, when 20 organizations were listed, following four in June and none in July. September and October each added five listings, while November contributed four at collection time. These dates track publication activity; they should not be treated as confirmed intrusion dates.

Reported Attack Methods, Defensive Priorities, and Evidence Gaps

Gurucul describes initial access through phishing, exposed Remote Desktop Protocol services, compromised credentials, and VPN access sourced from infostealer logs or initial access brokers.

The reported operation targets Windows environments and follows double-extortion, stealing sensitive information before encryption and threatening publication if negotiations fail. This creates separate risks involving business disruption and data exposure.

That distinction matters because restoring files does not remove the threat of stolen information becoming public. Related reporting on data theft extortion tactics explains why recovery alone cannot resolve every ransom demand.

Dark Project’s Tor leak site serves as its public pressure channel, publishing alleged victim details when the operators seek additional leverage.

The report maps activity to techniques including abuse of valid accounts, Windows Management Instrumentation, RDP, SMB, data exfiltration, encryption, and attempts to inhibit recovery.

It also lists associated vulnerabilities, but does not provide sufficient incident evidence to establish every listed flaw as a confirmed Dark Project entry point. Defenders should distinguish reported associations from demonstrated exploitation.

Manufacturing accounts for 12 reported victims, healthcare for seven, and construction for four. Those concentrations make access monitoring and recovery readiness important priorities for exposed organizations.

Gurucul recommends patching, stronger access controls, suspicious-activity monitoring, and secure backups. Security teams can use those measures without assuming that every affiliate follows an identical intrusion sequence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post New Dark Project Ransomware Group Offers Hackers 80% Commission to Expand Cyberattacks appeared first on Cyber Security News.