Dark Project ransomware expands with an 80% affiliate cut

A ransomware group called Dark Project is recruiting criminal partners with an offer of 80% of proceeds from successful attacks. First observed in June 2026, the operation combines data theft, file encryption, and public leak threats to pressure organizations into paying.

Its published victim records cover 38 organizations across eight countries, and the United States accounts for 30 listings. Manufacturing, healthcare, and construction appear most often, and those figures come from threat intelligence and leak-site records rather than independently verified compromises.

Dark Project’s affiliate program and payment terms

Dark Project advertises a partner program under which affiliates receive 80% of proceeds while its operators keep 20% for platform services and reporting. The advertised terms resemble established ransomware affiliate revenue models used by other criminal groups, but they do not prove that partners receive payments as promised.

Recruitment follows four stages: application, vetting and onboarding, deployment, and commission settlement. Applicants contact the group through Tox, and approved partners reportedly receive a unique identifier, platform access, and operational instructions before deploying payloads against organizations. Dark Project also says it handles victim communication and ransom negotiations, and it promises commission payments within 24 hours of a completed engagement.

Infrastructure and reported activity

Researchers from Gurucul identified Dark Project in a threat actor profile that documents its recruitment process, infrastructure, and reported attack methods. Their findings describe an emerging operation that uses the language of legitimate security services to advertise tools and partner support for ransomware activity.

The advertised infrastructure includes a Tor-hosted operations dashboard, agents supplied in EXE and BIN formats, and a social-engineering simulation suite. Agents reportedly contain partner identifiers that allow activity to be linked to individual affiliates. These are platform claims documented by Gurucul rather than capabilities independently demonstrated through published malware analysis.

Separating payload deployment from negotiations leaves affiliates with fewer operational tasks to manage. The report compares that setup with affiliate management features seen in Lynx ransomware operations, where partners can manage victim profiles and leak schedules. Dark Project also promotes Bitcoin payments, but the report provides no wallet addresses or transaction evidence confirming settlements.

Victim listings and timing

Victim disclosures peaked in August 2026, when 20 organizations were listed, following four in June and none in July. September and October each added five listings, while November contributed four at collection time. Those dates track publication activity and should not be treated as confirmed intrusion dates.

Reported attack methods and evidence gaps

Gurucul describes initial access through phishing, exposed Remote Desktop Protocol services, compromised credentials, and VPN access sourced from infostealer logs or initial access brokers. The reported operation targets Windows environments and follows double-extortion, stealing sensitive information before encryption and threatening publication if negotiations fail.

Dark Project’s Tor leak site serves as a public pressure channel, publishing alleged victim details when the operators seek additional leverage. The report maps activity to abuse of valid accounts, Windows Management Instrumentation, RDP, SMB, data exfiltration, encryption, and attempts to inhibit recovery.

It also lists associated vulnerabilities, but does not provide enough incident evidence to establish every listed flaw as a confirmed Dark Project entry point. Manufacturing accounts for 12 reported victims, healthcare for seven, and construction for four. Gurucul recommends patching, stronger access controls, suspicious-activity monitoring, and secure backups.