Dark Project Ransomware Group Escalates Global Extortion Campaign with 80% Affiliate Commission Model

Executive Summary

Encrygma threat intelligence analysts have identified a significant escalation in ransomware activity driven by the 'Dark Project' group. Since June 2026, this actor has utilized a high-incentive affiliate model, offering 80% commissions to attract cybercriminals. Encrygma data confirms this strategy has resulted in at least 38 documented victim organizations across eight countries, with a heavy concentration in the United States.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, Dark Project operates as a sophisticated Ransomware-as-a-Service (RaaS) entity. By offering an 80% commission, the group is successfully lowering the barrier to entry for lower-tier threat actors. Encrygma analysts assess the group's current threat level at 'High' on the Encrygma Threat Severity Index (ETSI), noting their rapid expansion into the agriculture, manufacturing, and healthcare sectors.

Technical Details

Encrygma threat data shows that Dark Project employs a classic double-extortion methodology, combining file encryption with the exfiltration of sensitive data. The group maintains a public leak site to pressure victims into payment. Recent incidents, such as the breach of the Food Bank of Central Louisiana, demonstrate the group's focus on exfiltrating banking, financial, and personal identifiable information (PII) to maximize leverage during negotiations.

Attribution Assessment

Based on the Encrygma Attribution Confidence Matrix, our assessment of Dark Project's operational structure is 'High Confidence'. While the group's core leadership remains obscured, their recruitment tactics and infrastructure patterns align with established cybercriminal syndicates. Encrygma analysts observe that the group is actively leveraging the current volatility in the RaaS market to poach experienced affiliates from older, declining ransomware operations.

Implications

Encrygma threat data indicates that the shift toward high-commission RaaS models is creating a more fragmented and aggressive threat landscape. Organizations in the US and abroad face an increased risk of targeted attacks as Dark Project continues to scale its operations. The group's willingness to target non-profit and critical infrastructure entities suggests a lack of ethical boundaries, further increasing the potential for operational disruption.

Recommendations

Encrygma recommends that organizations implement robust, multi-layered defense strategies. First, prioritize the hardening of external-facing assets against credential-based attacks, which remain the primary vector for Dark Project. Second, ensure that offline, immutable backups are maintained and tested regularly. Finally, organizations should integrate real-time threat intelligence feeds into their Security Operations Centers (SOC) to detect early-stage reconnaissance and lateral movement associated with Dark Project's known infrastructure.