# Dark Project Ransomware Group Tempts Cybercriminals with Lucrative Commissions

*Published November 9, 2026*
*Source: [https://cybersecuritynews.com/new-dark-project-ransomware-group/](https://cybersecuritynews.com/new-dark-project-ransomware-group/)*

## Executive Summary

The Dark Project ransomware group is recruiting affiliates by offering them 80 percent of attack proceeds, using tactics like data theft and encryption to pressure organizations. This emerging threat targets various sectors and employs a structured approach to recruit and manage partners for its operations.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/dark-project-ransomware-group-tempts-cybercriminals-with-lucrative-commissions) or [see plans](https://www.sec-news.ai/pricing).*

## Article

The Dark Project ransomware group is making waves in the cybercrime world by offering enticing commissions to recruit criminal partners. This group promises affiliates an 80 percent share of the proceeds from successful cyberattacks, providing a platform to manage extortion operations. First identified by Gurucul researchers in June 2026, Dark Project employs a combination of data theft, file encryption, and public leak threats to compel organizations to pay ransoms. Victim records from the group cover 38 organizations across eight countries, with a significant focus on the United States. Sectors such as manufacturing, healthcare, and construction have been particularly affected. However, these figures are based on threat intelligence and leak-site records, not independently verified compromises.

The group's recruitment process involves a structured four-stage procedure: application, vetting and onboarding, deployment, and commission settlement. Affiliates are required to contact Dark Project through Tox, and if approved, they receive a unique identifier, platform access, and operational instructions. The group takes charge of victim communication and ransom negotiations, promising commission payments within 24 hours of a successful engagement. Dark Project's infrastructure includes a Tor-hosted operations dashboard, agents in EXE and BIN formats, and a social-engineering simulation suite. This setup is designed to minimize operational tasks for affiliates by separating payload deployment from negotiations.

The group's operations have been mapped to various techniques, including the abuse of valid accounts, Windows Management Instrumentation, and data exfiltration. These activities target Windows environments and follow a double-extortion model, where sensitive information is stolen before encryption. This model creates dual risks of business disruption and data exposure, as restoring files does not eliminate the threat of public data leaks. The peak of victim disclosures occurred in August 2026, with subsequent activity reported in the following months. Gurucul's recommendations for defending against such threats include patching vulnerabilities, strengthening access controls, monitoring for suspicious activities, and maintaining secure backups.