Dark Project Ransomware: Gang Advertises 80% Cut to Affiliates, About 40 Organizations Named, and What to Check This Week

A ransomware group calling itself Dark Project is advertising 80 percent of ransom proceeds to criminals who carry out attacks for it, and leak-site trackers now show about 40 organizations named on its site, most of them in the United States. It matters to businesses because an offer like that is built to attract more attackers, and this group reportedly steals data before it locks systems, so backups alone will not end the threat.

Here is what we could check, what we could not, and what to do this week.

What is Dark Project ransomware?

Dark Project is described as a ransomware operation that runs as an affiliate program: the operators supply the tools and the leak site, and outside partners carry out the break-ins. According to Cyber Security News, in a November 6, 2026 summary of a threat actor profile by security vendor Gurucul, the group combines data theft, file encryption and the threat of publishing stolen files on a Tor leak site.

A note on sourcing: Gurucul's page would not open for us, so every detail credited to Gurucul here comes second hand through that summary. The victim counts were checked on two trackers we could open.

Dark Project ransomware: what is confirmed and what is claimed

Who is Dark Project ransomware targeting?

Manufacturing and healthcare lead in both data sets. Breachsense identifies a sector for 36 victims: manufacturing 12, healthcare 7, logistics 3, and technology, automotive, construction, energy and financial services at 2 each. It warns this is not a full census.

The Gurucul summary shows listings peaking at 20 in August, then 5 in September, 5 in October and 4 in November at the time of collection. Those are publication dates, not the dates of the break-ins.

Nothing we opened shows the group choosing targets by company size. Treat the sector list as a pattern so far, not a boundary.

How does Dark Project ransomware get in?

The reported routes are phishing, exposed Remote Desktop (RDP), compromised passwords, and VPN access obtained from infostealer logs or initial access brokers. The reported target is Windows environments, with attackers moving through networks using valid accounts, WMI, RDP and SMB, then stealing data, encrypting files and interfering with recovery.

Security Arsenal listed five candidate flaws in an August analysis, including CVE-2026-50751 in Check Point gateways and CVE-2024-1708 in ConnectWise ScreenConnect. It ties none of them to a specific Dark Project victim, so read that list as an informed guess.

Breachsense adds one useful data point: 29.3 percent of the Dark Project victims whose domain it can identify had employee logins leak in the 12 months before the group named them. Breachsense says it does not know whether those logins were how the group got in.

Why the ransomware affiliate model matters for a business

This part is our reading, not a reported fact. An 80 percent share is a recruiting pitch, and affiliate programs spread the work across many independent attackers. That can mean more attempts using ordinary routes, such as a reused VPN password or a forgotten remote desktop port.

The data theft is the bigger issue for a company. Good backups can get you running again, but they cannot pull stolen customer, patient or employee records back. A leak can also trigger legal notification duties, so ask your counsel before you need the answer.

What to do about Dark Project ransomware this week

Dark Project ransomware questions people are asking

Is Dark Project ransomware a real group?

Yes. Two independent trackers show an active leak site naming about 40 organizations. Whether each listing is a genuine breach is not confirmed.

Has Dark Project hit my company?

Check a public tracker for your name, but a clean result proves little. The group reportedly publishes victim details when it wants more leverage, so a breach can exist before any listing does.

How do we monitor the Dark Project leak site?

Use a tracker such as RansomLook or Breachsense, or a monitoring service, and set alerts for your company and key vendors. Staff should not browse criminal Tor sites from company machines.

Are there Dark Project indicators of compromise to block?

Not in the reporting we reviewed. The Cyber Security News summary lists no file hashes, domains, IP addresses or Bitcoin addresses, so defenses have to rest on access controls and behavior monitoring.

Is there a Dark Project decryptor?

None of the sources we opened mention one. CISA advises consulting federal law enforcement about possible decryptors.

Should a business pay a Dark Project ransom?

That decision belongs with counsel and your insurer. In advisory AA25-071A, the FBI, CISA and their co-authors say they do not encourage paying, because payment does not guarantee files will be recovered and may embolden attackers.

Who do we report a ransomware attack to?

CISA lists itself, your local FBI field office, the FBI's Internet Crime Complaint Center (IC3) and your local Secret Service field office. The FBI and CISA urge prompt reporting whether or not you pay.

The bigger lesson

New ransomware names appear constantly, and the details about each one often start as the criminals' own advertising. You do not need to know which group is next to prepare for it. The routes reported here are familiar ones: exposed remote access, stolen logins and unpatched edge devices. Close those, keep a backup that attackers cannot reach, and decide ahead of time who makes the hard calls.

To find out what your network exposes, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Breachsense, Dark Project profile; RansomLook, Dark Project; Cyber Security News, summarizing Gurucul; Security Arsenal; CISA #StopRansomware Guide; CISA advisory AA25-071A.