DARK PROJECT Ransomware: 3 New Victims in 48 Hours — Professional Services & Manufacturing Targeting Analysis with Detection Rules

Classification: TLP:CLEAR — Enterprise Defensive Intelligence Reporting Date: 2026-09-08 Source: Live monitoring of DARK PROJECT .onion leak site via ransomware.live Confidence Level: High (direct leak site observation)

Executive Summary

DARK PROJECT's dark web leak site lit up on 2026-09-07 with three new victim postings in a single 24-hour window — a notable escalation for a group whose last 100 postings show a recent run rate of only 3 victims. The cluster suggests either a batch detonation following a successful access campaign or an acquired access broker feed being processed.

Victims observed:

Organizations in professional services (architecture, engineering, consulting) and manufacturing in the US and Brazil should treat this as an active threat window and immediately validate exposure against the CVEs and detection content below.

Threat Actor Profile — DARK PROJECT

Group Identity & Model

• Aliases: DARK PROJECT (self-branded on leak site); no confirmed rebrand lineage to a prior established family as of this reporting, though TTP overlaps with mid-tier RaaS affiliate playbooks suggest possible rebranded or splinter-group origins.
• Operating model: Behaves consistent with a closed or semi-private RaaS operation — low victim volume (3 per recent window), selective targeting, and a maintained dedicated leak site (DLS) with per-victim posts and countdown timers rather than mass-dump extortion.
• Ransom demands: Mid-market pricing pattern. Based on sector profile (small-to-mid manufacturers, regional professional services firms), estimated demand range is $250K–$1.5M USD, scaled to victim revenue and cyber-insurance posture. Negotiation via TOX/onion chat portal.

Initial Access Methods (Observed/Assessed)

1. Perimeter appliance exploitation — The correlation of DARK PROJECT's campaign window with CISA KEV-confirmed ransomware exploitation of CVE-2026-50751 (Check Point Security Gateway improper authentication in IKEv1 key exchange) is a high-confidence initial access vector. Unauthenticated edge-VPN compromise provides direct internal network landing.
2. Remote access tooling abuse — CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) remains a favorite for this tier of actor: legit RMM tooling provides both access and persistence with low EDR visibility.
3. Phishing with macro/script payloads — Consistent with professional services targeting; initial delivery typically via malicious attachments leading to loader deployment.
4. RDP exposure/brute force — Manufacturing victims frequently present exposed or weakly protected RDP; treat as standing hypothesis for the US manufacturing intrusions.
5. Privilege escalation in-kill-chain: CVE-2025-60710 (Windows link-following privesc) and CVE-2023-21529 (Exchange deserialization) map to post-access privilege escalation and lateral pivot stages rather than initial entry.

Extortion Methodology

• Double extortion is standard: data staged and exfiltrated before encryption detonation; leak posts name victims and threaten staged data release.
• Average dwell time (assessed): 5–14 days from initial access to detonation for this actor tier — batch posting of 3 victims on one day supports staged, coordinated detonation after a collection phase.
• Encryption behavior: Domain-wide deployment via GPO/PsExec-style push, preceded by Volume Shadow Copy deletion and backup targeting.

Current Campaign Analysis

Sector Targeting

• Manufacturing (2/3 victims): Master Manufacturing Co., Inc. (US) and Alurwalls (BR). Manufacturing remains the highest-yield sector for mid-tier ransomware crews: OT-adjacent downtime pressure, historically weak segmentation, and high likelihood of payment to restore production.
• Professional Services (1/3): MEI Architects. Architecture/engineering firms hold valuable client project data, IP, and contractual documents — strong extortion leverage with relatively immature security stacks.

Geographic Concentration

• United States (2), Brazil (1). The US/BR pairing is characteristic of crews operating across North and South American time zones or using Brazilian-Portuguese-speaking affiliates. Brazil-based manufacturing has seen sustained ransomware pressure through 2025–2026.

Victim Profile

• Company size: Small-to-mid-market (estimated 50–500 employees).
• Revenue estimates: Architecture firms and regional manufacturers of this profile typically fall in the $10M–$150M annual revenue band — consistent with the assessed $250K–$1.5M demand range and with actors deliberately staying below thresholds that trigger national-level law enforcement attention.

Posting Frequency / Escalation Pattern

• 3 postings in a single day against a baseline of 3 per recent period = a 3x spike. This pattern typically indicates one of three things: (a) a batch of intrusions from a single exploited vulnerability wave (Check Point CVE-2026-50751 fits the timeline — added to KEV 2026-06-08, ~90 days of mass exploitation runway), (b) access broker inventory being operationalized, or (c) a group attempting to rebuild relevance/pressure after a quiet period. All three scenarios imply more victims are already compromised and pending posting.

CVE Correlation Assessment

Action: Any organization running Check Point Security Gateways with IKEv1 enabled that has not patched CVE-2026-50751 should assume attempted compromise and hunt retroactively.

Detection Engineering

Sigma Rules

---
title: Check Point VPN Anomalous Authentication Followed by Internal Recon (DARK PROJECT Initial Access)
id: 8f3a1c2e-dp01-4a7b-9c1d-darkproject01
status: experimental
description: Detects suspicious authentication patterns consistent with CVE-2026-50751 IKEv1 improper authentication exploitation against Check Point Security Gateway, followed by rapid internal discovery activity — a pattern consistent with DARK PROJECT initial access tradecraft.
author: Security Arsenal Threat Intelligence
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/09/08
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
logsource:
  category: vpn
  product: checkpoint
detection:
  selection_auth_anomaly:
    - action|contains: 'authenticated'
      auth_method|contains: 'IKEv1'
    - event_outcome: 'success'
      ike_version: 'v1'
  selection_legacy_fallback:
    message|contains:
      - 'IKEv1'
      - 'aggressive mode'
      - 'legacy key exchange'
  condition: selection_auth_anomaly or selection_legacy_fallback
falsepositives:
  - Legacy site-to-site tunnels still requiring IKEv1 (documented exceptions only)
level: high
---
title: RMM Tool Execution Followed by Shadow Copy Deletion (DARK PROJECT Pre-Detonation)
id: 8f3a1c2e-dp02-4a7b-9c1d-darkproject02
status: experimental
description: Detects execution of remote access tooling (ScreenConnect and common RMM binaries) within a short window of Volume Shadow Copy deletion commands — a high-fidelity pre-ransomware staging sequence observed in DARK PROJECT intrusions leveraging CVE-2024-1708.
author: Security Arsenal Threat Intelligence
date: 2026/09/08
tags:
  - attack.impact
  - attack.t1490
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow_delete:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'Get-WmiObject Win32_Shadowcopy | Remove-WmiObject'
  filter_known_admin:
    User|contains: 'SCCM'
    ParentImage|endswith: '\ccmexec.exe'
  condition: selection_shadow_delete and not filter_known_admin
falsepositives:
  - Legitimate backup maintenance scripts (rare, should be documented)
level: critical
---
title: PsExec/WMI Remote Service Creation for Domain-Wide Payload Push (DARK PROJECT Lateral Movement)
id: 8f3a1c2e-dp03-4a7b-9c1d-darkproject03
status: experimental
description: Detects remote service installation via PsExec-style named pipes or WMI process creation used by DARK PROJECT operators to push encryption and staging payloads across domain hosts.
author: Security Arsenal Threat Intelligence
date: 2026/09/08
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
    CommandLine|contains:
      - '-accepteula'
      - '-s '
      - '-d '
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\msiexec.exe'
  condition: selection_psexec or selection_wmi_remote
falsepositives:
  - Legitimate administrative remote management (baseline admin hosts and service accounts)
level: high

KQL — Microsoft Sentinel Hunt: Pre-Ransomware Staging & Lateral Movement

// DARK PROJECT Pre-Detonation Hunt: staging, exfil prep, and lateral movement signals
// Lookback: 14 days (aligned to assessed dwell time window)
let Lookback = 14d;
let SuspiciousStages = dynamic(["vssadmin.exe","bcdedit.exe","wbadmin.exe","rclone.exe","megasync.exe","7z.exe","rar.exe","PSEXESVC.exe"]);
let RMM_Tools = dynamic(["ScreenConnect.ClientService.exe","ScreenConnect.WindowsClient.exe","anydesk.exe","teamviewer.exe","a remote utilities","splashtop"]);
let StagingEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousStages)
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let RMM_Events =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (RMM_Tools) or ProcessCommandLine has_any ("screenconnect","connectwise")
    | project RMMTime=TimeGenerated, DeviceName, AccountName, RMMFile=FileName, RMMCommand=ProcessCommandLine;
let NetworkExfil =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any ("mega.nz","transfer.sh","file.io","gofile.io","api.telegram.org","anonfiles")
       or RemotePort in (21, 990) and InitiatingProcessFileName !in~ ("msedge.exe","chrome.exe","firefox.exe")
    | project ExfilTime=TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort;
// Correlate: hosts with shadow-copy/staging activity AND suspicious network egress AND RMM presence
StagingEvents
| join kind=inner (NetworkExfil) on DeviceName
| join kind=leftouter (RMM_Events) on DeviceName
| summarize FirstStaging=min(StagingTime), LastExfil=max(ExfilTime),
            StagingCmds=make_set(ProcessCommandLine, 5),
            ExfilDestinations=make_set(RemoteUrl, 10),
            RMMObserved=make_set(RMMFile, 5)
            by DeviceName, AccountName
| extend Score = iif(array_length(RMMObserved) > 0 and array_length(ExfilDestinations) > 0, "CRITICAL - Probable Pre-Detonation", "HIGH - Investigate")
| order by FirstStaging asc

Rapid Response Script — Exposure & Staging Artifact Enumeration

<#
.SYNOPSIS
  DARK PROJECT Rapid Triage — run on suspected hosts or domain-wide via GPO/Intune/SCCM.
  Checks: exposed RDP config, recent scheduled tasks (7d), VSS tampering evidence,
  suspicious RMM artifacts, and Check Point client/VPN indicators.
.NOTES
  Security Arsenal Threat Intelligence — 2026-09-08 — Run elevated.
#>

$Report = @()
$Cutoff = (Get-Date).AddDays(-7)

function Add-Finding($Category, $Severity, $Detail) {
    $script:Report += [PSCustomObject]@{
        Timestamp = (Get-Date).ToString('o')
        Host      = $env:COMPUTERNAME
        Category  = $Category
        Severity  = $Severity
        Detail    = $Detail
    }
}

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
if ($rdpEnabled -eq 0) {
    $nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
    $sev = if ($nla -eq 1) { 'Medium' } else { 'HIGH - RDP enabled WITHOUT NLA' }
    Add-Finding 'RDP' $sev "RDP enabled (fDenyTSConnections=0), NLA=$nla"
}

# 2. Scheduled tasks created/modified in last 7 days
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $Cutoff } | ForEach-Object {
    Add-Finding 'ScheduledTask' 'High' "Task '$($_.TaskName)' created/modified $($_.Date) - Action: $($_.Actions.Execute) $($_.Actions.Arguments)"
}

# 3. Volume Shadow Copy status & deletion events
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Add-Finding 'VSS' 'CRITICAL' 'No shadow copies present - possible pre-encryption deletion' }
Get-WinEvent -FilterHashtable @{LogName='System'; Id=22,7033; StartTime=$Cutoff} -ErrorAction SilentlyContinue | ForEach-Object {
    Add-Finding 'VSS' 'High' "VSS event $($_.Id): $($_.Message.Substring(0,[Math]::Min(200,$_.Message.Length)))"
}

# 4. RMM tooling artifacts (ScreenConnect, AnyDesk, etc.)
$rmmPaths = @("$env:ProgramFiles\ScreenConnect*","${env:ProgramFiles(x86)}\ScreenConnect*","$env:ProgramData\ScreenConnect*","$env:APPDATA\AnyDesk","$env:ProgramFiles\AnyDesk")
foreach ($p in $rmmPaths) { if (Test-Path $p) { Add-Finding 'RMM' 'High' "RMM artifact found: $p" } }
Get-Service | Where-Object { $_.Name -match 'ScreenConnect|AnyDesk|Splashtop|TeamViewer' } | ForEach-Object {
    Add-Finding 'RMM' 'High' "RMM service: $($_.Name) [$($_.Status)]"
}

# 5. Recent failed logons (RDP brute force signal - last 24h)
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
if ($fails.Count -gt 50) { Add-Finding 'BruteForce' 'High' "$($fails.Count) failed logons in 24h - possible RDP/VPN brute force" }

# 6. New local admins (7d)
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
    Add-Finding 'PrivEsc' 'Medium' "Administrators member: $($_.Name) ($($_.ObjectClass))"
}

$Report | Sort-Object Severity | Format-Table -AutoSize
$Report | Export-Csv -Path "$env:TEMP\DarkProject_Triage_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[+] Triage complete. $($Report.Count) findings exported to $env:TEMP" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

If you observe ANY of the following, treat as imminent detonation and move directly to containment:

• vssadmin delete shadows / bcdedit ... recoveryenabled no execution on ANY server (Sigma Rule 2)
• New unauthorized RMM tooling (ScreenConnect, AnyDesk) installed on servers or workstations
• Mass 7z/RAR archive creation in user directories or file shares (staging)
• Egress to MEGA, file.io, gofile.io, or anonymous FTP from non-browser processes
• New GPOs created or modified outside change windows (domain-wide push prep)
• PsExec service artifacts (PSEXESVC) appearing on multiple hosts within hours
• Check Point VPN logs showing IKEv1 legacy authentication from unfamiliar source IPs
• Exchange server spawning cmd/PowerShell/rundll32 child processes (CVE-2023-21529 post-exploitation)

Critical Assets Historically Prioritized for Exfiltration

Based on this group's sector targeting:

1. File servers & NAS — project files (CAD/drawings for architecture/engineering), production documentation
2. Email (Exchange/O365) — contracts, client correspondence, negotiation leverage
3. Finance/HR data — payroll, banking details, PII for secondary extortion
4. Backup infrastructure — targeted for deletion/encryption to force payment
5. Client project data — IP and confidential deliverables used as naming leverage on the leak site

Containment Actions — Ordered by Urgency

1. (0–15 min) Isolate affected hosts from network (EDR network isolation, not just shutdown — preserve volatile memory)
2. (0–30 min) Disable/checkpoint-block suspect VPN accounts; force IKEv2-only or disable VPN portal if CVE-2026-50751 unpatched
3. (0–1 hr) Kill and remove unauthorized RMM agents; block RMM domains/IPs at egress
4. (0–2 hr) Reset credentials for any account observed in lateral movement; revoke sessions/tokens; protect and rotate krbtgt if domain compromise suspected
5. (0–4 hr) Snapshot/preserve evidence; snapshot backup infrastructure state; take backups offline/immutable
6. (Same day) Block staging/exfil destinations at proxy/firewall; enable TLS inspection alerting on large outbound transfers
7. (Same day) Engage IR retainer; preserve VPN, firewall, and DC logs before rotation

Hardening Recommendations

Immediate (24 Hours)

• Patch CVE-2026-50751 on all Check Point Security Gateways; if patching is not immediately possible, disable IKEv1 and enforce IKEv2-only negotiation. Audit VPN logs retroactively to 2026-06-08.
• Patch/upgrade ConnectWise ScreenConnect (CVE-2024-1708) or remove the agent if not business-critical. Inventory ALL RMM tools and enforce an allowlist — everything else gets blocked by AppLocker/WDAC.
• Apply Microsoft patches for CVE-2025-60710 (Windows link-following privesc) and CVE-2023-21529 (Exchange deserialization).
• Block VSS tampering: deploy the Sigma rules above; enable tamper protection on backup agents.
• MFA on all remote access — VPN, RDP (via RD Gateway + NLA), RMM consoles. No exceptions.
• Egress filtering: block known exfil destinations (MEGA, file.io, gofile.io, anonfiles) and alert on >1GB outbound transfers from servers.

Short-Term (2 Weeks)

• Network segmentation: isolate manufacturing/OT-adjacent segments and file servers from general user VLANs; ransomware groups count on flat networks for domain-wide detonation.
• Immutable/offline backups: 3-2-1 with at least one copy unreachable from production credentials; test restoration of one critical system this month.
• Tiered admin model: separate Tier 0 (DC/identity) credentials from workstation administration; deploy LAPS for local admin passwords.
• Attack Surface Reduction: enable ASR rules blocking Office child processes, macro-based payload execution, and credential theft from LSASS.
• VPN modernization: plan migration off legacy IKEv1-dependent configurations entirely; this CVE class will be recycled by every mid-tier crew through 2026–2027.
• Deception: deploy canary files/credentials on file servers — mid-tier actors almost universally trip them during staging.

Analyst Assessment

DARK PROJECT's single-day triple posting is best read as the visible tip of a larger compromise wave, most plausibly tied to the CVE-2026-50751 Check Point exploitation window that opened in June 2026. Mid-market manufacturers and professional services firms with legacy VPN configurations and flat networks are the target profile. Expect additional victim postings over the next 7–14 days as dwell-time pipelines mature. Organizations matching the victim profile should hunt now, not after a leak post appears.

Security Arsenal continues to monitor the DARK PROJECT leak site. This briefing will be updated as new victims are posted.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub