Dark Project ransomware group recruits affiliates with 80% revenue share
RANSOMWAREDark Projectredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Dark Project, first observed in June 2026, runs a ransomware-as-a-service partner programme with an 80/20 affiliate split, according to Gurucul. Its leak site lists 38 victims across eight countries, 30 of them in the United States, mainly in manufacturing, healthcare and construction. Initial access is reportedly gained through phishing, exposed RDP, compromised credentials and VPN access from infostealer logs or initial access brokers, with double extortion of Windows environments.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Restrict or remove exposed Remote Desktop Protocol services and enforce strong access controls.
- Enforce multi-factor authentication on VPN and remote access and review accounts for compromised credentials.
- Monitor for suspicious activity such as abuse of valid accounts, WMI and SMB use, and large data transfers.
- Maintain secure, offline backups and confirm that you can restore from them.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Threat actors