Dark Project Advertises 80% Affiliate Payouts as Ransomware Victim Claims Expand

Dark Project, a financially motivated ransomware operation reportedly first observed in June 2026, is advertising an affiliate program offering partners 80% of attack proceeds. Reporting attributed to Gurucul describes a double-extortion model combining data theft, file encryption, and public leak threats, with advertised deployment tools and centralized ransom negotiations for affiliates. Published victim listings name 38 organizations across eight countries, including 30 in the United States, with manufacturing, healthcare, and construction prominently represented. The listings do not independently establish that the organizations were compromised, and the advertised capabilities and commission payments remain unverified.

Gurucul separately reported three newly listed victims in the United States and the Philippines spanning energy, transportation and logistics, and automotive businesses, without naming them. Its report describes exposed-service exploitation and remote-access abuse and provides indicators and detection queries for suspicious execution, recovery inhibition, remote-access tools, and external IKEv1 connections; however, it does not establish that these techniques or tools were used against those three organizations. Defenders should prioritize patching internet-facing services, strengthening remote-access controls, monitoring for encryption and backup-disruption activity, and maintaining secure backups. Restoring encrypted systems would not resolve exposure from stolen data.