Threat video1:00
Dark Project Ransomware 38 Victims: Detection & IOCs
Dark Project's affiliates claim 38 victims in 8 countries, led by manufacturing. Its 9 detection rules, 12 IOCs and a free Splunk SPL rule map the attack.
Read the full threat intel for Dark Project Ransomware 38 Victims: Detection & IOCs →
Chapters
- 0:00The hookDark Project ransomware claims 38 victims.
- 0:04The storyAugust peaked with 20 victims.
- 0:10Attack pathReportedly: phishing, exposed access, or stolen credentials.
- 0:28AttributionAttributed to Dark Project.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from initial access to impact.
- 0:43Remediation5 steps now: Enforce MFA on all remote access paths.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Dark Project ransomware claims 38 victims.
0:05August peaked with 20 victims.
0:07By November, claimed total: 38.
0:11Reportedly: phishing, exposed access, or stolen credentials.
0:15Attackers deploy remote-monitoring tools, spread via S-M-B.
0:19Stage encrypted data, exfiltrate, destroy backups.
0:23Encrypt systems, extort through Tor portal.
0:29Attributed to Dark Project. Confidence: low.
0:33No malicious indicators were published.
0:3913 ATT&CK techniques, from initial access to impact.
0:445 steps now: Enforce MFA on all remote access paths.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.