Dark Project ransomware group recruits affiliates with 80% revenue share
- Severity
- High
- Sources
- 1
What happened
Gurucul profiles Dark Project, a double-extortion ransomware operation first observed in June 2026 that recruits affiliates via Tox and a Tor-hosted dashboard, offering 80% of proceeds with 24-hour commission settlement. Agents in EXE and BIN formats reportedly embed partner identifiers, though this is a platform claim, not demonstrated malware analysis. Reported access vectors include phishing, exposed RDP, compromised credentials and VPN access from infostealer logs or initial access brokers; techniques include WMI, SMB and inhibit-recovery. No CVEs are confirmed as entry points, and no hashes, domains, IPs or wallet addresses were published. Defenders should prioritise patching, RDP and VPN hardening, credential hygiene, monitoring and offline backups.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Restrict or remove exposed Remote Desktop Protocol services and enforce strong access controls.
- Enforce multi-factor authentication on VPN and remote access and review accounts for compromised credentials.
- Monitor for suspicious activity such as abuse of valid accounts, WMI and SMB use, and large data transfers.
- Maintain secure, offline backups and confirm that you can restore from them.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors