Research

Dark Project, a New Ransomware Crew, Lists 38 Victims in Eight Countries and Pays Affiliates 80%. All of That Is the Gang's Own Claim, and the Report Publishes No Indicators.

Patrick Duggan · · 3 min read

Dark Project, a New Ransomware Crew, Lists 38 Victims in Eight Countries and Pays Affiliates 80%. All of That Is the Gang's Own Claim, and the Report Publishes No Indicators.

If you run a manufacturing, healthcare or construction business, the useful part of the Dark Project reports is the way in, not the victim count. The reports say affiliates get in through phishing, exposed remote desktop, stolen credentials, and VPN access bought from infostealer logs or access brokers. That list is old. It is worth checking against your own setup this week anyway, because the crew is recruiting.

Dark Project ransomware, as claimed and reported. Left: what is reported. 38 victims in 8 countries on the group's own leak site, 30 in the United States, 2 in the United Kingdom, one each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada. Manufacturing 12, healthcare 7, construction 4. Affiliates keep 80 percent of ransom payments and the operator keeps 20. Middle: what is disputed. Ransomware.live lists 40 victims. The June start is uncorroborated because public trackers show first listings in August. Disclosure dates are not intrusion dates. Listings by month: June 4, July 0, August 20, September 5, October 5, November 4 so far. Right: what to do. Check for exposed remote desktop, require MFA on VPN, check employee credentials against infostealer exposure, and look for outbound bulk transfers. No indicators were published and none were ingested.

What is reported

GBHackers, drawing on a profile from the security firm Gurucul, reports that Dark Project is a financially motivated ransomware and data extortion group. It steals data, encrypts systems, and threatens to publish the data on a Tor leak site. The leak site lists 38 victims in eight countries: 30 in the United States, two in the United Kingdom, and one each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada. By sector, the report counts manufacturing at 12, healthcare at seven and construction at four. It does not sort the other 15.

The group also advertises an affiliate program. Affiliates are said to keep 80 percent of each ransom and the operator 20 percent, for platform services and reporting. The reported recruitment flow is contact over the Tox messenger, vetting, onboarding, an affiliate identifier, payload deployment and commission settlement. Operators handle victim communication and negotiation, and affiliates handle the intrusion. Payment is advertised in Bitcoin.

What is not solid

  • The numbers are the gang's claims. The report says plainly that these are allegations published through criminal infrastructure, not independently confirmed breaches.
  • The total moves. Ransomware.live lists 40 victims for the same group.
  • The start date is shaky. The snapshot shows four listings in June, none in July and 20 in August. Public trackers describe first listings in August, so the June figure is uncorroborated.
  • A listing is not an intrusion. Disclosure dates say when the crew posted a victim, not when it got in.
  • The report does not say why those sectors. It does not establish that affiliates picked manufacturing, healthcare or construction on purpose.

What the reports do not give

No encryptor name, no file extension, no ransom note text, no leak site address, no hashes, no IP addresses, no domains, and no named victims. The only technical detail is that affiliate payloads are EXE and BIN agents that carry an affiliate identifier, and a list of ATT&CK techniques: WMI, SMB, credential abuse, exfiltration, encryption and recovery inhibition. So there is nothing for us to add to the feed, and we did not ingest anything.

What to check this week

  • Find any remote desktop service reachable from the internet and close it or put it behind a VPN.
  • Require multi-factor authentication on VPN sign-in, and make sure there is no second sign-in path that skips it. Our SonicWall post from today is an example of that gap.
  • Check whether your employees' credentials show up in infostealer exposure data. Bought VPN access starts there.
  • Watch for large outbound transfers to unfamiliar destinations. Double extortion needs the data out before the encryption starts.
  • Test that backups cannot be deleted from a domain admin account, since the reports mention recovery inhibition.

These checks are general practice for any affiliate-model ransomware. They are our suggestions, not findings from the reports.

Limits

We did not read Gurucul's profile: the site returned a 403 to our fetch. We read GBHackers' summary of it and search coverage of other outlets. We have no sighting of this group from our own sensors and we did not test anything. The counts, percentages and dates are as reported and can change as the leak site changes.

Five percent of this is wrong somewhere. It always is. Gurucul's full profile will correct a count or a date.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register