A relatively new ransomware operation calling itself Dark Project is trying to grow fast by out-paying its criminal rivals. The group is offering recruited affiliates 80% of whatever ransom proceeds they bring in, keeping just 20% for itself in exchange for running the back-end platform, handling victim negotiations, and processing payments — a pitch researchers at security firm Gurucul say mirrors the affiliate economics of established ransomware brands, just with a more generous split.

Dark Project was first observed in June 2026 and has since combined the now-standard double-extortion playbook — stealing data, encrypting files, and threatening public leaks — to pressure victims into paying. Gurucul’s threat actor profile documents 38 organizations named on the group’s leak infrastructure across eight countries, with the United States accounting for 30 of those listings and manufacturing, healthcare, and construction companies featuring prominently. It’s worth noting these figures reflect what the group itself has published on leak-site and threat-intelligence records, not independently verified breach counts.

A four-stage pipeline for recruiting criminal partners

What distinguishes Dark Project from a purely technical ransomware strain is how deliberately it is being marketed as a service. According to Gurucul’s research, the group runs a structured onboarding pipeline for new affiliates:

• Application — prospective partners make initial contact through the encrypted messaging app Tox
• Vetting and onboarding — approved applicants receive a unique partner identifier along with platform access and operational instructions
• Deployment — affiliates run the actual intrusion and ransomware deployment against a chosen target
• Commission settlement — the operation claims to pay out affiliate commissions within 24 hours of a completed, paid engagement

The advertised back-end includes a Tor-hosted operations dashboard, malware agents distributed in both EXE and BIN formats, and what Gurucul describes as a social-engineering simulation suite — tooling apparently meant to help affiliates rehearse phishing or pretexting before going after a real target. The agents reportedly embed each partner’s unique identifier, which would let the operators track which affiliate is responsible for which attack and calculate commissions accordingly. Gurucul is careful to note that these are platform capabilities as advertised by the group, rather than claims independently verified through published malware analysis.

Why splitting negotiation from intrusion matters

By having the core operation handle victim communication, ransom negotiation, and payment logistics centrally, Dark Project reduces the operational burden on individual affiliates, who only need to handle the technical break-in and payload deployment. Security researchers have observed similar centralized management features in other ransomware-as-a-service operations, where affiliate partners can track victim status and leak-publication schedules through a shared dashboard rather than coordinating manually.

Dark Project also promotes Bitcoin as its payment method of choice, though Gurucul’s report does not include wallet addresses or on-chain transaction evidence that would independently confirm any ransom has actually been paid out through the platform.

A timeline that tracks disclosure, not necessarily intrusion

Victim disclosures on the group’s infrastructure spiked in August 2026, when 20 organizations appeared on its listings, up from four in June and none at all in July. September and October each added five more listings, with four additional organizations named in November at the time Gurucul’s data was collected. Researchers caution these dates reflect when victims were published, not necessarily when the underlying intrusions occurred.

How the group reportedly gets in — and how to stop it

Gurucul’s analysis describes Dark Project affiliates relying on familiar initial-access methods: phishing emails, exposed Remote Desktop Protocol services, compromised credentials, and VPN access purchased from infostealer malware logs or initial-access brokers. The operation targets Windows environments and follows the standard double-extortion sequence of data theft followed by encryption.

Given that profile, the defensive priorities are the same ones security teams have heard for several ransomware generations running: close exposed RDP to the internet or lock it behind multi-factor authentication, monitor for credential-stuffing and infostealer-sourced logins, and maintain offline, tested backups so that encryption alone cannot force a payment decision. The commission-driven affiliate model Dark Project is advertising suggests the group is actively trying to scale its attack volume, which makes broad hygiene against commodity initial-access techniques more relevant than ever for organizations in its apparent target sectors.