Dark Project

Dark Project, also styled DARK PROJECT, is a financially motivated ransomware operation first observed in June 2026. It operates an affiliate-based ransomware-as-a-service model and advertises an 80% share of attack proceeds for affiliates, retaining 20% for its operators. The operation recruits and vets partners and advertises deployment tools, an affiliate-management dashboard, and centralized victim communications and ransom negotiations. Dark Project uses double extortion: attackers steal sensitive organizational data before encrypting systems and threaten to publish the stolen information unless victims pay. The group maintains a Tor-hosted leak site to publicize alleged victims and increase pressure during negotiations. Its targeting is concentrated in the United States, with additional reported targets in Brazil and the Philippines. Affected sectors include manufacturing, healthcare, construction and engineering, professional services, retail, hospitality, food production, nonprofit organizations, energy, and transportation and logistics. Reported initial-access methods include phishing, exposed Remote Desktop Protocol services, compromised accounts, and VPN access obtained through infostealer logs or initial access brokers. The operation targets Windows environments, with reported activity involving valid-account abuse, Windows Management Instrumentation, RDP, SMB, data exfiltration, encryption, and attempts to inhibit recovery. Published victim listings are allegations rather than independent confirmation of every compromise. Advertised platform capabilities and affiliate-payment promises have not been independently demonstrated.