Dark Project, an emerging financially motivated ransomware operation, has claimed 38 victims across eight countries in the supplied threat intelligence snapshot, with manufacturing and healthcare bearing the heaviest exposure.
The group combines data theft, system encryption, and public disclosure threats with an affiliate program designed to scale intrusions.
The figures represent allegations published through criminal infrastructure, not independently confirmed breaches.
Counts also vary by collection window: Ransomware. live lists 40 victims across eight countries, underscoring why the supplied 38-victim dataset should be treated as a snapshot rather than a definitive current total.
Manufacturing represents 12 reported victims, healthcare seven, and construction four. Together, manufacturing and healthcare account for half the dataset.
Bitcoin is advertised for settlement. References to Coinbase and Binance describe purchasing options, not evidence that either exchange participates in or endorses the operation.
These figures describe the distribution of disclosed victims; they do not establish whether affiliates deliberately prioritized these sectors or exploited whichever organizations presented accessible entry points.
Dark Project Ransomware
The snapshot dates the earliest activity to June 2026, with four disclosures. August recorded 20 listings, followed by five each in September and October and four in November.
The supplied records identify 30 organizations in the United States, followed by two in the United Kingdom. Germany, Brazil, the Philippines, Turkey, Mexico, and Canada each account for one listing.
Public trackers instead describe emergence or first observed listings in August, leaving the earlier timeline uncorroborated. Disclosure dates should not be interpreted as intrusion dates.
Gurucul Researchers said that, Dark Project advertises an 80% affiliate commission, retaining 20% for platform services and reporting.
Its recruitment workflow involves Tox contact, vetting, onboarding, assignment of a partner identifier, payload deployment, and commission settlement.
Operators claim responsibility for victim communication and ransom negotiations, while affiliates handle deployments.
Advertised infrastructure includes a Tor-hosted dashboard, EXE and BIN agents carrying affiliate identifiers, and social-engineering tooling.
These are operator claims, not independently validated capabilities. Nevertheless, the arrangement describes a ransomware-as-a-service structure that separates intrusion activity from centralized extortion management.
Dark Project follows a double-extortion model: stealing sensitive information before encrypting systems, then threatening publication through its Tor leak portal.
Public ransomware tracking independently describes this combination of encryption and disclosure pressure.
The supplied intelligence attributes initial access to phishing, exposed RDP, compromised credentials, and VPN access acquired through infostealer logs or access brokers. Its ATT&CK mapping includes WMI, SMB, credential abuse, exfiltration, encryption, and recovery inhibition.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
