Dark Project Ransomware Group Recruits Affiliates with 80% Commission Offer
The emerging Dark Project ransomware group is actively recruiting cybercriminals with a lucrative 80% commission offer, leveraging a sophisticated platform to manage attacks and extort victims.
A new ransomware operation, dubbed Dark Project, has emerged with an aggressive recruitment strategy, offering potential affiliates a substantial 80% commission on all successful extortion payments. First observed in June 2026, this financially motivated group employs a double-extortion model, combining data theft and encryption with the threat of public data leaks to coerce victims into paying ransoms. Researchers from Gurucul have documented the group's operations, detailing its recruitment process, infrastructure, and reported attack methodologies.
The Dark Project group advertises its partner program through a Tor-hosted dashboard, promising affiliates a significant share of the profits while retaining 20% for platform services and operational costs. This model closely mirrors established ransomware-as-a-service (RaaS) operations, though the actual payment of commissions remains unverified. The recruitment process is structured into four stages: application, vetting, deployment, and commission settlement. Interested parties are directed to contact the group via Tox, and approved partners receive unique identifiers, platform access, and operational guidance.
Affiliates are reportedly provided with agents in EXE and BIN formats, along with a social-engineering suite designed to aid in initial access and victim engagement. These agents are said to contain partner identifiers, allowing Dark Project operators to track activity and attribute it to specific affiliates. The group claims to handle all victim communications and ransom negotiations, aiming to streamline the process for its partners and ensure prompt commission payouts within 24 hours of a concluded engagement.
Initial access methods employed by Dark Project affiliates are varied, including traditional phishing campaigns, exploitation of exposed Remote Desktop Protocol (RDP) services, the use of compromised credentials, and access gained through infostealer logs or initial access brokers. The ransomware targets Windows environments, and its double-extortion tactics mean that even if victims restore their systems, the threat of sensitive data exposure remains, creating a dual risk of operational disruption and reputational damage.
Dark Project maintains a public leak site on the Tor network, where it publishes details of alleged victim organizations to exert additional pressure during negotiations. Gurucul's analysis indicates that the group's tactics, techniques, and procedures (TTPs) include the abuse of valid accounts, exploitation of Windows Management Instrumentation (WMI), RDP, and SMB, alongside data exfiltration and encryption. While certain vulnerabilities are listed, the extent to which Dark Project actively exploits them in confirmed intrusions is not fully detailed.
Victimology data, based on public disclosures and leak site records, shows a concentration of attacks in the United States, with manufacturing, healthcare, and construction sectors being particularly targeted. While these figures represent reported victim listings rather than independently verified compromises, they highlight key sectors for increased security vigilance. Gurucul recommends robust security measures such as patching, stringent access controls, continuous monitoring for suspicious activities, and maintaining secure, offline backups.
The group's operational model, which separates payload deployment from negotiation management, aims to reduce the burden on affiliates. This approach is reminiscent of features seen in other ransomware operations, allowing partners to focus on initial access and deployment while the core group handles the complex extortion process. The emphasis on Bitcoin for payments is standard, though specific wallet addresses or transaction details are not publicly available to confirm settlement processes.
As Dark Project continues to recruit and refine its operations, organizations, particularly those in the manufacturing, healthcare, and construction sectors, should bolster their defenses against ransomware and data extortion tactics. The group's aggressive affiliate program and comprehensive support platform signal a determined effort to expand its reach and impact in the cybercriminal landscape.