Dark Project ransomware-as-a-service claims 38 victims in 8 countries, mostly manufacturing and healthcare
Dark Project, an emerging financially motivated ransomware operation, has claimed 38 victims across eight countries in the threat intelligence snapshot the article relies on. Manufacturing (12) and healthcare (7) lead, followed by construction (4). The figures are leak-site allegations, not confirmed breaches. Ransomware.live lists 40 victims, so the 38 is a snapshot rather than a current total. The article rests on a Gurucul report and gives no vendor advisory, CVE or confirmed intrusion detail.
Detalhes técnicos
- Model: ransomware-as-a-service with double extortion. Data is stolen, systems are encrypted, and publication is threatened on a Tor leak portal. Public trackers corroborate the combined encryption and disclosure pressure.
- Affiliate program: an advertised 80% commission to affiliates, with 20% kept by the operators. Recruitment runs through Tox contact, vetting, onboarding, a partner ID, payload deployment and commission settlement. Operators say they handle victim communication and negotiation. These are operator claims and are not independently validated.
- Advertised tooling: a Tor-hosted dashboard, EXE and BIN agents carrying affiliate identifiers, and social-engineering tooling. Ransoms are settled in Bitcoin. The Coinbase and Binance references describe purchasing options only and do not mean either exchange is involved.
- Initial access (per the supplied intelligence): phishing, exposed RDP, compromised credentials, and VPN access bought through infostealer logs or access brokers. The ATT&CK mapping covers WMI, SMB, credential abuse, exfiltration, encryption and recovery inhibition.
- Victims by country: United States 30, United Kingdom 2, and one each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada.
- Timeline: the snapshot shows 4 disclosures in June 2026, 20 in August, 5 in September, 5 in October and 4 in November. Public trackers date the first listings to August, so the June activity is uncorroborated. Disclosure dates are not intrusion dates.
Remediação
The article gives no remediation. Its access vectors point to these checks: exposed RDP, VPN credential hygiene and MFA, infostealer-log monitoring, and phishing defenses.
Linha do tempo
-
Dark Project ransomware-as-a-service claims 38 victims in 8 countries, mostly manufacturing and healthcare
ler a análise desta fonte ocultar
Dark Project, an emerging financially motivated ransomware operation, has claimed 38 victims across eight countries in the threat intelligence snapshot the article relies on. Manufacturing (12) and healthcare (7) lead, followed by construction (4). The figures are leak-site allegations, not confirmed breaches. Ransomware.live lists 40 victims, so the 38 is a snapshot rather than a current total. The article rests on a Gurucul report and gives no vendor advisory, CVE or confirmed intrusion detail.
Technical Details
- Model: ransomware-as-a-service with double extortion. Data is stolen, systems are encrypted, and publication is threatened on a Tor leak portal. Public trackers corroborate the combined encryption and disclosure pressure.
- Affiliate program: an advertised 80% commission to affiliates, with 20% kept by the operators. Recruitment runs through Tox contact, vetting, onboarding, a partner ID, payload deployment and commission settlement. Operators say they handle victim communication and negotiation. These are operator claims and are not independently validated.
- Advertised tooling: a Tor-hosted dashboard, EXE and BIN agents carrying affiliate identifiers, and social-engineering tooling. Ransoms are settled in Bitcoin. The Coinbase and Binance references describe purchasing options only and do not mean either exchange is involved.
- Initial access (per the supplied intelligence): phishing, exposed RDP, compromised credentials, and VPN access bought through infostealer logs or access brokers. The ATT&CK mapping covers WMI, SMB, credential abuse, exfiltration, encryption and recovery inhibition.
- Victims by country: United States 30, United Kingdom 2, and one each in Germany, Brazil, the Philippines, Turkey, Mexico and Canada.
- Timeline: the snapshot shows 4 disclosures in June 2026, 20 in August, 5 in September, 5 in October and 4 in November. Public trackers date the first listings to August, so the June activity is uncorroborated. Disclosure dates are not intrusion dates.
Remediation
The article gives no remediation. Its access vectors point to these checks: exposed RDP, VPN credential hygiene and MFA, infostealer-log monitoring, and phishing defenses.