# Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing

> Dark Project is an emerging financially motivated double-extortion ransomware operation running an affiliate program (80% affiliate / 20% operator split). It has claimed 38 victims across 8 countries (30 in the US), led by manufacturing (12), healthcare (7) and construction (4). Claims are posted on criminal infrastructure and are not independently confirmed.

- **Published:** 2026-11-06T11:44:37Z
- **Last reviewed:** 2026-11-06T15:39:30.170Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5409
- **ID:** TL-2026-5409
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Dark Project
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

Dark Project is a ransomware and data-extortion operation reported by Gurucul researchers (as summarized by GBHackers on 2026-11-06). The operators claim 38 victims across 8 countries: 30 in the United States, 2 in the United Kingdom, and 1 each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada. Sector breakdown of claimed victims is manufacturing 12, healthcare 7 and construction 4; manufacturing and healthcare together account for about half of the dataset. Some trackers report 40 victims. Reported listing cadence is June 2026 (4), August (20), September (5), October (5) and November (4). All victim data are allegations published through criminal infrastructure and are not independently confirmed breaches.

The operation follows a double-extortion model: data is stolen, systems are encrypted, and victims are threatened with public disclosure on a Tor-hosted leak portal. Operators handle victim communication and ransom negotiation, while affiliates handle intrusion and payload deployment. The affiliate program advertises an 80% affiliate commission with the operator retaining 20% for platform services. The reported onboarding workflow is Tox contact, vetting, onboarding, partner ID assignment, payload deployment and settlement. Infrastructure includes a Tor-hosted dashboard, EXE and BIN agents carrying affiliate identifiers, and social-engineering tooling. Bitcoin is advertised for ransom settlement, with references to Coinbase and Binance as purchasing options.

Reported initial access vectors are phishing, exposed RDP, compromised credentials, and VPN access obtained through infostealer logs or access brokers. Reported post-compromise behavior maps to WMI and SMB lateral movement, credential abuse, exfiltration, encryption and recovery inhibition. Secondary analysis from SecurityArsenal (an assessment based on victim profile, not confirmed incident data) describes PsExec/PAExec/RemCom and WMI lateral movement, Cobalt Strike or commodity loaders, RMM abuse (including ScreenConnect), shadow copy deletion via vssadmin/wmic, password-protected 7-Zip/RAR staging, and exfiltration with rclone, MEGAsync, WinSCP, FileZilla and PScp. It also estimates 5-14 days of dwell time, with exfiltration starting 48-72 hours before encryption, and ransom demands of $250K-$2M. No CVE exploitation is confirmed by the primary source, so CVEs named in secondary hypotheses are deliberately excluded.

Sources disagree on timing and scale. GBHackers reports first activity in June 2026. WatchGuard's tracker lists a victim dated 2026-04-30, 19 known victims, 9 Tor leak servers, and email and Tox contact channels. SOCRadar describes the group as emerging in August 2026 and as a closed or tightly curated affiliate model. Defenders should treat Dark Project as an active threat, particularly in manufacturing, healthcare and mid-market organizations. Priorities are securing remote access (VPN, RDP, RMM) with MFA, monitoring for infostealer-derived credential use, and protecting backups against recovery inhibition. No public IOCs (hashes, IPs, domains, onion addresses, ransom note text) were available in the sources.

## MITRE ATT&CK

- T1566 Phishing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1047 Windows Management Instrumentation
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1560.001 Archive Collected Data: Archive via Utility
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery
- T1657 Financial Theft
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dark Project RDP Brute-Force Followed by Successful External RDP Logon (TL-2026-5409)** (`TL-2026-5409-SPL-001`)

Fires when a public source IP produces 5+ failed network/RDP logons against a host and then a successful RDP logon within 24 hours. Dark Project (TL-2026-5409) affiliates are reported to gain initial access via exposed RDP and compromised credentials (T1133, T1078, T1021.001); the failed-logon burst is password guessing (T1110). Dwell time before encryption is reported at 5-14 days before encryption. Behavioural, self-contained, and requires only Windows Security 4624/4625 events.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1133, T1078, T1021.001, T1110
- **Data sources:** windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" earliest=-24h ((EventCode=4625 Logon_Type IN (3,10)) OR (EventCode=4624 Logon_Type=10))
| eval src=coalesce(Source_Network_Address, src_ip)
| where isnotnull(src) AND src!="-" AND src!="::1" AND NOT cidrmatch("10.0.0.0/8",src) AND NOT cidrmatch("172.16.0.0/12",src) AND NOT cidrmatch("192.168.0.0/16",src) AND NOT cidrmatch("127.0.0.0/8",src) AND NOT cidrmatch("169.254.0.0/16",src)
| eval failed=if(EventCode=4625,1,0), success=if(EventCode=4624,1,0)
| stats sum(failed) as failed_logons, sum(success) as rdp_success, values(Account_Name) as accounts, min(_time) as first_seen, max(_time) as last_seen by host, src
| where failed_logons>=5 AND rdp_success>=1
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host, src, accounts, failed_logons, rdp_success, first_seen, last_seen
```

### Microsoft KQL

```kql
let window = 24h;
let ExternalFailures = DeviceLogonEvents
| where Timestamp > ago(window)
| where ActionType == "LogonFailed" and LogonType in ("Network", "RemoteInteractive")
| where RemoteIPType == "Public"
| summarize FailedLogons = count(), FirstFail = min(Timestamp), TargetAccounts = make_set(AccountName, 10) by RemoteIP, DeviceName
| where FailedLogons >= 5;
DeviceLogonEvents
| where Timestamp > ago(window)
| where ActionType == "LogonSuccess" and LogonType == "RemoteInteractive"
| where RemoteIPType == "Public"
| join kind=inner ExternalFailures on RemoteIP, DeviceName
| where Timestamp >= FirstFail
| project Timestamp, DeviceName, AccountName, RemoteIP, RemotePort, FailedLogons, TargetAccounts
```

### Sigma

```yaml
title: Dark Project TL-2026-5409 - Successful RDP Logon From Public IP Address
id: 3f1c7a52-5409-4b8e-9a31-0d6c2e4f1a01
status: experimental
description: Detects a successful RemoteInteractive (RDP) logon whose source address is outside private ranges. Dark Project affiliates gain initial access through exposed RDP and compromised or infostealer-derived credentials. Pair with the failed-logon burst correlation in the SPL and KQL forms.
references:
    - https://gbhackers.com/dark-project-ransomware/
    - https://securityarsenal.com/blog/dark-project-ransomware-4-us-victims-posted-in-24-hours-professional-services-and-manufacturing-in-the-crosshairs
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.initial-access
    - attack.persistence
    - attack.t1133
    - attack.t1078
    - attack.lateral-movement
    - attack.t1021.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_internal:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
    filter_local:
        IpAddress:
            - '-'
            - '::1'
    condition: selection and not 1 of filter_*
falsepositives:
    - VPN concentrators or jump hosts that proxy RDP from public NAT addresses
    - Administrators or vendors with approved remote support over RDP
level: high

```

**Known false positives:**

- Legitimate users mistyping passwords repeatedly before an approved remote RDP session from a public address
- Vulnerability scanners or red-team exercises that brute-force RDP from external ranges

**Tuning notes:** Raise or lower the failed_logons threshold per environment. Exclude known VPN egress, bastion and vendor-support IP ranges using a lookup. Restrict to servers and high-value assets to cut noise. Ensure Logon_Type and Source_Network_Address are extracted by the Splunk Windows TA.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Dark Project Phishing Execution - Office/Outlook Spawning Script Interpreter (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project Data Staging - Password-Protected 7-Zip/RAR Archive Creation (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project Lateral Movement - WMI Remote Process Creation (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project Exposed RDP - Inbound 3389 From Public IP (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project Exfiltration Tooling - rclone/MEGAsync/WinSCP/PScp/FileZilla (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project C2 - ScreenConnect RMM and Community Cobalt Strike IPs (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project Recovery Inhibition - Shadow Copy and Backup Deletion (TL-2026-5409) (locked: unlock with TL Creds)
- Dark Project Lateral Movement - PsExec/PAExec/RemCom Execution (TL-2026-5409) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- Domain: `darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid[.]onion`
- Domain: `wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd[.]onion`
- Domain: `7iphetz64a7iihcpwr3nirjioghyt6lrku62gu4z7f3zo7rcz5qrgvad[.]onion`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing](https://gbhackers.com/dark-project-ransomware/)
- [SecurityArsenal: Dark Project Ransomware - 4 US Victims Posted in 24 Hours](https://securityarsenal.com/blog/dark-project-ransomware-4-us-victims-posted-in-24-hours-professional-services-and-manufacturing-in-the-crosshairs)
- [WatchGuard Ransomware Tracker: Dark Project](https://www.watchguard.com/es/wgrd-security-hub/ransomware-tracker/dark-project)
- [SOCRadar: Dark Project ransomware profile](https://socradar.io/data-breach/ransomware/dark-project/)
- [SOCRadar Ransomware Intelligence: Dark Project](https://socradar.io/free-tools/ransomware-intelligence/groups/dark-project)
- [SOCRadar: Leviton Data Breach (Dark Project claim)](https://socradar.io/blog/data-breach/leviton-dark-project-ransomware-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5409