VULNpocalypse
LowBreach / campaignMonitoring

Dark Project ransomware group claims 38 victims in 8 countries, according to Gurucul research

Outlets report Gurucul research on Dark Project, a ransomware group claiming 38 victims; review exposed RDP, VPN access and credentials.

Published
Exploitation
No, not confirmed: the victim listings are leak-site claims that the reporting outlets say are not independently verified

What happened

On November 6, 2026, GBHackers and Cyber Security News reported on a threat actor profile by researchers at Gurucul. The profile covers a ransomware group called Dark Project. According to both outlets, the group claims 38 victims across eight countries (GBHackers, Cyber Security News). Both outlets say these figures are allegations published through criminal infrastructure and leak-site records. They are not independently confirmed breaches. The sources do not report that any listed victim has confirmed an incident.

According to GBHackers, the counts depend on the collection window. Ransomware.live lists 40 victims across eight countries, so the 38-victim figure should be read as a snapshot (GBHackers).

The two outlets report the following details from the Gurucul profile:

  • Victims by country: 30 listings are in the United States and two in the United Kingdom. Germany, Brazil, the Philippines, Turkey, Mexico and Canada each have one (GBHackers).
  • Victims by sector: manufacturing has 12 reported victims, healthcare seven and construction four (Cyber Security News).
  • Timeline of listings:
    • four in June 2026
    • none in July
    • 20 in August
    • five each in September and October
    • four in November at collection time

Both outlets say these are disclosure or publication dates, not intrusion dates (GBHackers, Cyber Security News). GBHackers adds that public trackers describe first observed listings in August, which leaves the earlier timeline uncorroborated (GBHackers).

  • Affiliate program: Dark Project advertises an 80% commission for affiliates and keeps 20% for platform services and reporting (Cyber Security News).
  • Recruitment: applicants contact the group through Tox. The described stages are vetting, onboarding, assignment of a partner identifier, payload deployment and commission settlement (GBHackers).
  • Division of roles: the operators claim to handle victim communication and ransom negotiations. Affiliates handle deployments (GBHackers).
  • Advertised infrastructure:
    • a Tor-hosted dashboard
    • EXE and BIN agents carrying affiliate identifiers
    • social-engineering tooling

Cyber Security News says these are platform claims documented by Gurucul. They are not capabilities independently demonstrated through published malware analysis (Cyber Security News).

  • Extortion model: according to the reports, the group uses double extortion. It steals data, encrypts Windows systems and threatens publication on a Tor leak site (Cyber Security News).
  • Payment: the group advertises Bitcoin payments. The report provides no wallet addresses or transaction evidence (Cyber Security News).

What is not confirmed:

  • Victim identities: the sources do not name the victims.
  • Victim confirmation: the sources do not report that any victim has confirmed an incident.
  • Data volumes: not confirmed.
  • Entry points: Cyber Security News says the Gurucul report lists associated vulnerabilities but does not provide enough incident evidence to establish every listed flaw as a confirmed Dark Project entry point. The outlet does not name those vulnerabilities (Cyber Security News).

Am I affected?

The sources do not name any victim organization. They also publish no indicators of compromise. Cyber Security News states that hashes, attacker domains or IPs, Tor or Tox identifiers and Bitcoin wallet addresses were not provided (Cyber Security News).

As reported, Gurucul’s profile attributes initial access to the following methods (GBHackers):

  • phishing
  • exposed Remote Desktop Protocol services
  • compromised credentials
  • VPN access obtained through infostealer logs or access brokers

The reported operation targets Windows environments (Cyber Security News). If your organization runs Windows with internet-facing RDP or VPN access, those are the reported risk areas. Exposure alone does not mean you are affected.

What to do now

  1. Review remote access. Check internet-facing RDP and VPN access and the accounts that use it. Gurucul recommends stronger access controls (Cyber Security News).
  2. Patch exposed systems. Patching is among Gurucul’s recommendations, according to Cyber Security News. The specific vulnerabilities listed in its profile are not named in these sources (Cyber Security News).
  3. Monitor for the reported techniques. Watch for suspicious activity of these types (Cyber Security News):
    • abuse of valid accounts
    • WMI, RDP and SMB activity
    • data exfiltration
    • attempts to inhibit recovery
  4. Keep secure backups and plan for data exposure. Gurucul recommends secure backups. Cyber Security News notes that restoring files does not remove the threat of stolen data being published (Cyber Security News).

Sources