Ransomware needs a way in. Stolen credentials are the cheapest one.
dark project Ransomware Group
Ransomware group profile
Description
Dark Project is a financially motivated double-extortion ransomware and data-extortion operation that emerged in August 2026. The group uses a dedicated Tor leak portal to publish stolen sensitive data, coercing organizations into paying ransoms to avoid exposure of corporate files and personal records. Their opportunistic targeting spans multiple industries and geographic regions, aiming for high volume data breaches.
Key insights
- •Initial access is achieved through phishing, exploiting remote desktop services, or compromised credentials from infostealer logs.
- •Dark Project exfiltrates vast amounts of sensitive data, from 40GB to over 2TB, including personal and financial records.
- •They employ a double-extortion tactic using a Tor-based leak site to publish stolen data if ransoms are not paid.
- •The group targets various sectors opportunistically, including healthcare, manufacturing, and professional services.
- •Publication of victim identifiers and dataset volumes occurs on their dedicated leak portal.
- •Financial gain is the primary motivation for their criminal activities.
Threat Level & Status Breakdown
For dark project · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for dark project in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for dark project
T1560
Archive Collected Data
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1105
Ingress Tool Transfer
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1048
T1048
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(6)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Pump Engineering Company | United States | Claimed | 12 days ago | |
| Dentist in New Britain | United States | Claimed | 12 days ago | |
| Jones, Little & Co., CPAs, LLP | United States | Claimed | 12 days ago | |
| The Liberty Group Company | United States | Data Leaked | 12 days ago | |
| Furnished Quarters | United States | Claimed | 12 days ago | |
| Design-Aire Engineering | United States | Claimed | 12 days ago |
Affected countries(7)
Countries where this group has been reported to target or leak victims.