Dark Project, a newly profiled ransomware-as-a-service operation, is recruiting affiliates with an 80% share of ransom proceeds and already lists two UK organisations among its claimed victims. The way it gets in is familiar: phishing, exposed remote desktop and stolen VPN logins. That makes it a test of basic hygiene more than of advanced defence.
What happened
Researchers at Gurucul have published a threat actor profile of Dark Project, a financially motivated extortion crew that steals data before encrypting systems and then threatens to publish it on a Tor leak site. The profile, reported by GBHackers and Cyber Security News on 6 November 2026, covers the group’s affiliate scheme, recruitment process, advertised tooling and the attack methods attributed to it.
In the snapshot Gurucul analysed, the group claims 38 victims across eight countries. The United States accounts for 30 of those listings and the United Kingdom for two. Canada, Mexico, Turkey, the Philippines, Brazil and Germany have one each. By sector, manufacturing leads with 12 listings, followed by healthcare with seven and construction with four.
These figures need care. They come from the gang’s own leak-site postings, not from confirmed incidents, and the public trackers disagree. Ransomware.live counts 40 victims, while SOCRadar’s profile, last updated on 27 October, shows 24. The sources also differ on when the group appeared. Cyber Security News says it was first seen in June 2026, but SOCRadar puts its emergence in August. A leak-site posting date also tells you when a victim was named, not when the network was breached. We are not naming the UK organisations listed, because no reputable source has confirmed those intrusions.
The technical picture
Dark Project is built for scale. Gurucul says the operators advertise an 80/20 split: affiliates keep 80% of each ransom and the platform keeps 20% for its services and reporting. Would-be partners make contact over the encrypted messenger Tox, then go through vetting and onboarding and receive a unique partner identifier before they are allowed to deploy. The operators say they handle victim communication and ransom negotiation themselves, which leaves affiliates free to concentrate on breaking into networks.
The advertised infrastructure includes a Tor-hosted dashboard, ransomware agents supplied in EXE and BIN formats with affiliate identifiers embedded, and what the group calls a social-engineering suite. Cyber Security News makes the point that these are platform claims recorded by Gurucul, not capabilities shown through published malware analysis. No hashes, domains, wallet addresses or Tox identifiers have been released.
The attack methods attributed to the group are entirely conventional. Gurucul lists four routes in:
- phishing
- internet-exposed Remote Desktop Protocol services
- compromised credentials
- VPN access bought from initial access brokers or harvested from infostealer logs
Once inside, the reported behaviour maps to standard MITRE ATT&CK techniques: misuse of legitimate accounts, Windows Management Instrumentation (WMI), lateral movement over RDP and SMB, data exfiltration, encryption, and steps to stop victims recovering. SOCRadar’s profile adds impairing defences, archiving collected data and transferring tools into the network. It also reports stolen datasets ranging from about 40GB to more than 2TB.
Why it matters for UK organisations
Two UK listings out of 38 is a small number, and it may simply reflect who happened to be reachable. The pattern matters more than the count. An 80% commission is aimed squarely at experienced affiliates who already hold access and are shopping around for a platform. When a new programme is that generous, it is usually trying to lure partners away from established brands, and those partners bring their access with them.
The sector mix should also worry UK boards. Manufacturing and healthcare together make up half of the claimed victims, and both sectors in the UK run plenty of flat networks, legacy remote access and third-party support connections. The group’s reliance on infostealer logs and access brokers means the breach often starts somewhere you cannot see. A contractor’s home laptop infected with a stealer can hand over a working VPN session long before anyone opens a phishing email.
Double extortion also raises a regulatory problem as well as an operational one. Restoring from backup gets systems running again, but it does nothing about stolen personal data. Where personal data has been taken, UK GDPR requires the ICO to be notified within 72 hours of becoming aware, unless the breach is unlikely to put people at risk, whatever the encryption did.
Expert view
Nothing in Gurucul’s profile is new tradecraft, and that is the uncomfortable lesson. When we run external tests and red team engagements, the routes this group relies on keep turning up as the fastest way in. RDP is exposed on a forgotten server. A VPN appliance accepts a password with no second factor. Credentials from an old infostealer infection still work months later. Ransomware affiliates are businesses: they follow the cheapest access, and a generous commission simply puts more money behind buying it.
In my experience, organisations underestimate the infostealer problem most. Teams focus on phishing awareness, which matters, but stealer logs are traded in bulk and often include session cookies that sidestep MFA altogether. If your identity monitoring only alerts on failed logins, a successful login with stolen material will look completely normal.
I would also be cautious about the victim figures. Leak sites are partly marketing, especially for a group recruiting affiliates. Inflated or recycled listings help sell the platform. The missing indicators also mean defenders cannot simply block their way out of this one. Detection has to be based on behaviour, not signatures.
What to do now
- Close exposed RDP. No RDP service should be reachable from the internet. Put remote administration behind a VPN or a zero trust gateway, and confirm the result with an external scan. This maps directly to the Cyber Essentials firewall and secure configuration controls.
- Enforce phishing-resistant MFA on every remote access path. That means VPNs, remote desktop gateways, webmail and cloud administration portals, including access used by suppliers and contractors. This falls under the Cyber Essentials user access control requirements.
- Treat infostealer exposure as an incident. Subscribe to credential exposure monitoring. When a hit comes in, reset the password, revoke active sessions and tokens, and check the source device for malware.
- Watch for misuse of valid accounts. Alert on VPN logins from new locations or hosting providers, unusual WMI and remote service creation, SMB activity between workstations, and large outbound transfers.
- Protect your ability to recover. Keep offline or immutable backups, test restores, and monitor for shadow copy deletion and attempts to tamper with backup software.
- Prepare for data theft, not just encryption. Rehearse ICO notification, legal and communications decisions in advance, and use the NCSC’s ransomware guidance and Exercise in a Box to test the plan.
Bottom line
Dark Project is a young operation whose victim claims cannot be verified, but its business model is designed to attract skilled affiliates who already hold stolen access. Its entry points are the ones UK organisations have been told to close for years. Organisations that have removed exposed RDP, put strong MFA on remote access and act quickly on leaked credentials take away most of what this kind of crew needs.
