Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing

Key facts for Dark Project ransomware

Detection coverage for Dark Project ransomware

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5409 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dark Project RDP Brute-Force Followed by Successful External RDP Logon (TL-2026-5409)

Fires when a public source IP produces 5+ failed network/RDP logons against a host and then a successful RDP logon within 24 hours. Dark Project (TL-2026-5409) affiliates are reported to gain initial access via exposed RDP and compromised credentials (T1133, T1078, T1021.001); the failed-logon burst is password guessing (T1110). Dwell time before encryption is reported at 5-14 days before encryption. Behavioural, self-contained, and requires only Windows Security 4624/4625 events.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1133, T1078, T1021.001, T1110
• Data sources: windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" earliest=-24h ((EventCode=4625 Logon_Type IN (3,10)) OR (EventCode=4624 Logon_Type=10))
| eval src=coalesce(Source_Network_Address, src_ip)
| where isnotnull(src) AND src!="-" AND src!="::1" AND NOT cidrmatch("10.0.0.0/8",src) AND NOT cidrmatch("172.16.0.0/12",src) AND NOT cidrmatch("192.168.0.0/16",src) AND NOT cidrmatch("127.0.0.0/8",src) AND NOT cidrmatch("169.254.0.0/16",src)
| eval failed=if(EventCode=4625,1,0), success=if(EventCode=4624,1,0)
| stats sum(failed) as failed_logons, sum(success) as rdp_success, values(Account_Name) as accounts, min(_time) as first_seen, max(_time) as last_seen by host, src
| where failed_logons>=5 AND rdp_success>=1
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host, src, accounts, failed_logons, rdp_success, first_seen, last_seen

Microsoft KQL

let window = 24h;
let ExternalFailures = DeviceLogonEvents
| where Timestamp > ago(window)
| where ActionType == "LogonFailed" and LogonType in ("Network", "RemoteInteractive")
| where RemoteIPType == "Public"
| summarize FailedLogons = count(), FirstFail = min(Timestamp), TargetAccounts = make_set(AccountName, 10) by RemoteIP, DeviceName
| where FailedLogons >= 5;
DeviceLogonEvents
| where Timestamp > ago(window)
| where ActionType == "LogonSuccess" and LogonType == "RemoteInteractive"
| where RemoteIPType == "Public"
| join kind=inner ExternalFailures on RemoteIP, DeviceName
| where Timestamp >= FirstFail
| project Timestamp, DeviceName, AccountName, RemoteIP, RemotePort, FailedLogons, TargetAccounts

Sigma

title: Dark Project TL-2026-5409 - Successful RDP Logon From Public IP Address
id: 3f1c7a52-5409-4b8e-9a31-0d6c2e4f1a01
status: experimental
description: Detects a successful RemoteInteractive (RDP) logon whose source address is outside private ranges. Dark Project affiliates gain initial access through exposed RDP and compromised or infostealer-derived credentials. Pair with the failed-logon burst correlation in the SPL and KQL forms.
references:
    - https://gbhackers.com/dark-project-ransomware/
    - https://securityarsenal.com/blog/dark-project-ransomware-4-us-victims-posted-in-24-hours-professional-services-and-manufacturing-in-the-crosshairs
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.initial-access
    - attack.persistence
    - attack.t1133
    - attack.t1078
    - attack.lateral-movement
    - attack.t1021.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_internal:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
    filter_local:
        IpAddress:
            - '-'
            - '::1'
    condition: selection and not 1 of filter_*
falsepositives:
    - VPN concentrators or jump hosts that proxy RDP from public NAT addresses
    - Administrators or vendors with approved remote support over RDP
level: high

Known false positives:

• Legitimate users mistyping passwords repeatedly before an approved remote RDP session from a public address
• Vulnerability scanners or red-team exercises that brute-force RDP from external ranges

Tuning notes: Raise or lower the failed_logons threshold per environment. Exclude known VPN egress, bastion and vendor-support IP ranges using a lookup. Restrict to servers and high-value assets to cut noise. Ensure Logon_Type and Source_Network_Address are extracted by the Splunk Windows TA.

• 🔒 Dark Project Phishing Execution - Office/Outlook Spawning Script Interpreter (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project Data Staging - Password-Protected 7-Zip/RAR Archive Creation (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project Lateral Movement - WMI Remote Process Creation (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project Exposed RDP - Inbound 3389 From Public IP (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project Exfiltration Tooling - rclone/MEGAsync/WinSCP/PScp/FileZilla (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project C2 - ScreenConnect RMM and Community Cobalt Strike IPs (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project Recovery Inhibition - Shadow Copy and Backup Deletion (TL-2026-5409) · unlock with TL Creds
• 🔒 Dark Project Lateral Movement - PsExec/PAExec/RemCom Execution (TL-2026-5409) · unlock with TL Creds

Indicators of compromise for Dark Project ransomware

As of 2026-11-06, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5409.

Sample indicators (3 of 25)

• Domain: darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid[.]onion
• Domain: wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd[.]onion
• Domain: 7iphetz64a7iihcpwr3nirjioghyt6lrku62gu4z7f3zo7rcz5qrgvad[.]onion

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How Dark Project ransomware works

Claims are posted on criminal infrastructure and are not independently confirmed.

Dark Project is a ransomware and data-extortion operation reported by Gurucul researchers (as summarized by GBHackers on 2026-11-06). The operators claim 38 victims across 8 countries: 30 in the United States, 2 in the United Kingdom, and 1 each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada. Sector breakdown of claimed victims is manufacturing 12, healthcare 7 and construction 4; manufacturing and healthcare together account for about half of the dataset. Some trackers report 40 victims. Reported listing cadence is June 2026 (4), August (20), September (5), October (5) and November (4). All victim data are allegations published through criminal infrastructure and are not independently confirmed breaches.

The operation follows a double-extortion model: data is stolen, systems are encrypted, and victims are threatened with public disclosure on a Tor-hosted leak portal. Operators handle victim communication and ransom negotiation, while affiliates handle intrusion and payload deployment. The affiliate program advertises an 80% affiliate commission with the operator retaining 20% for platform services. The reported onboarding workflow is Tox contact, vetting, onboarding, partner ID assignment, payload deployment and settlement. Infrastructure includes a Tor-hosted dashboard, EXE and BIN agents carrying affiliate identifiers, and social-engineering tooling. Bitcoin is advertised for ransom settlement, with references to Coinbase and Binance as purchasing options.

Reported initial access vectors are phishing, exposed RDP, compromised credentials, and VPN access obtained through infostealer logs or access brokers. Reported post-compromise behavior maps to WMI and SMB lateral movement, credential abuse, exfiltration, encryption and recovery inhibition. Secondary analysis from SecurityArsenal (an assessment based on victim profile, not confirmed incident data) describes PsExec/PAExec/RemCom and WMI lateral movement, Cobalt Strike or commodity loaders, RMM abuse (including ScreenConnect), shadow copy deletion via vssadmin/wmic, password-protected 7-Zip/RAR staging, and exfiltration with rclone, MEGAsync, WinSCP, FileZilla and PScp. It also estimates 5-14 days of dwell time, with exfiltration starting 48-72 hours before encryption, and ransom demands of $250K-$2M. No CVE exploitation is confirmed by the primary source, so CVEs named in secondary hypotheses are deliberately excluded.

Sources disagree on timing and scale. GBHackers reports first activity in June 2026. WatchGuard's tracker lists a victim dated 2026-04-30, 19 known victims, 9 Tor leak servers, and email and Tox contact channels. SOCRadar describes the group as emerging in August 2026 and as a closed or tightly curated affiliate model. Defenders should treat Dark Project as an active threat, particularly in manufacturing, healthcare and mid-market organizations. Priorities are securing remote access (VPN, RDP, RMM) with MFA, monitoring for infostealer-derived credential use, and protecting backups against recovery inhibition. No public IOCs (hashes, IPs, domains, onion addresses, ransom note text) were available in the sources.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares

Execution

T1047 Windows Management Instrumentation

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing

Command and Control

T1219 Remote Access Tools

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft

Collection

T1560.001 Archive Collected Data: Archive via Utility

Exfiltration

T1567 Exfiltration Over Web Service; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Remediation for Dark Project ransomware

Immediate actions

• Enforce MFA on all remote access paths (VPN, RDP, RMM tooling)
• Block RDP exposure at the perimeter and require VPN with NLA for internal RDP
• Reset credentials found in infostealer logs and review VPN logins from unusual geographies or ASNs
• Hunt for shadow copy deletion (vssadmin/wmic), password-protected archive creation and bulk outbound transfer tools on servers
• Verify backups are immutable or offline and recoverable

Workarounds

• Disable unused remote access services and restrict SMB/WMI lateral movement between workstations

Longer-term hardening

• Deploy EDR with behavioral ransomware detection and tamper protection
• Allowlist approved RMM tools and alert on unapproved remote access software
• Segment backup infrastructure onto an isolated management network
• Implement egress filtering and exfiltration monitoring
• Run a double-extortion tabletop exercise with legal and communications teams

Affected and fixed versions

• Multiple — Windows enterprise environments (manufacturing, healthcare, construction and other mid-market organizations)

Timeline of Dark Project ransomware

Last updated 2026-11-06 · revalidated 1× · latest source

• 2026-04-30 WatchGuard's ransomware tracker records the earliest locked-ioc-28 victim extortion date (2026-04-30).
• 2026-06-01 First reported locked-ioc-28 activity (June 2026, 4 victim disclosures; exact day not stated in the source).
• 2026-08-01 August 2026 is the peak month with 20 victim listings; SOCRadar describes the group as emerging in August 2026.
• 2026-08-04 Three victims (Reid Electric Service, TSC Logistics, Long-Lewis Automotive Group) posted to the locked-ioc-28 leak site per SecurityArsenal (unconfirmed claims).
• 2026-08-07 SecurityArsenal publishes an analysis of the locked-ioc-28 leak-site postings with TTP and tooling assessments.
• 2026-08-24 Four US victims (professional services, hospitality, manufacturing) are posted on the leak site within 24 hours, per SecurityArsenal.
• 2026-09-01 5 further victims listed in September 2026.
• 2026-10-01 5 further victims listed in October 2026.
• 2026-11-01 4 further victims listed in November 2026, bringing the claimed total to 38 across 8 countries.
• 2026-11-06 GBHackers publishes Gurucul's threat actor profile of the locked-ioc-28 affiliate program and 38 claimed victims.

Update history

• 2026-11-06 — locked-ioc-28 Ransomware-as-a-Service Group Offers Affiliates 80% Commission: What changed No field escalation; severity HIGH and exploitability ACTIVE are unchanged. Record gains infrastructure indicators, techniques and timeline events. New indicators (13) Indicator values are withheld at this access level. New CVE

Sources cited for Dark Project ransomware

• WatchGuard Ransomware Tracker: Dark Project watchguard.com · Research
• SOCRadar: Dark Project ransomware profile socradar.io · Research
• SOCRadar Ransomware Intelligence: Dark Project socradar.io · Research
• SecurityArsenal: Dark Project Ransomware - 4 US Victims Posted in 24 Hours securityarsenal.com · Blog · 2026-08-24
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing gbhackers.com · News · 2026-11-06
• SOCRadar: Leviton Data Breach (Dark Project claim) socradar.io · News

More in ransomware

• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services
• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk