DARK PROJECT Ransomware: 4 US Victims Posted in 24 Hours — Professional Services & Manufacturing in the Crosshairs

DARK PROJECT's dark web leak site lit up on 2026-08-24 with four victim postings in a single 24-hour window — an unusually compressed disclosure cadence that suggests either a batch negotiation failure or a deliberate intimidation push against US small-to-mid-market organizations. All four victims are US-based and skew toward professional services, hospitality, and light manufacturing — classic mid-market ransomware economics where ransom affordability is high and security maturity is low.

Victims posted 2026-08-24:

This briefing translates that leak-site activity into detection engineering and containment priorities for defenders.

Threat Actor Profile — DARK PROJECT

• Aliases / branding: DARK PROJECT operates under a single consistent brand on its .onion leak infrastructure; no confirmed rebrands or splinter-cell lineage have been publicly attributed, though tradecraft overlap with mid-tier RaaS affiliate tooling (Cobalt Strike, PsExec, WMI-based lateral movement) is consistent with the broader post-LockBit affiliate ecosystem.
• Operating model: Behaves as a closed or tightly curated affiliate model rather than open RaaS. Low victim throughput (4 postings in the last 100 observed leak-site events cycle) indicates selective targeting, not spray-and-pray volume operations.
• Ransom demands: Consistent with mid-market US targeting — estimated demands in the $250K–$2M range, scaled to victim revenue. CPA firms and engineering shops are typically priced at the lower end with aggressive 72–120 hour payment timers.
• Initial access methods:
  • Perimeter/VPN exploitation — the strongest hypothesis given the current KEV overlap (see Campaign Analysis). Edge-device auth bypasses are the dominant initial vector for crews at this tier in 2026.
  • Phishing with macro/loader payloads delivering Cobalt Strike or commodity loaders.
  • Exposed RDP brute force or purchased access from initial access brokers (IABs).
  • RMM abuse — ConnectWise ScreenConnect exploitation (CVE-2024-1708) remains a favorite for MSP-adjacent access into exactly this victim profile (small firms outsourced to MSPs).
• Extortion model: Double extortion — data staged and exfiltrated before encryption; leak-site publication used as negotiation leverage. The simultaneous posting of all four victims suggests these intrusions reached the encryption stage days to weeks earlier.
• Dwell time: Estimated 5–14 days median from initial access to detonation for crews using this playbook; exfiltration typically begins 48–72 hours before encryption.

Current Campaign Analysis

Sector Targeting

• Professional Services (Accounting): Jones, Little & Co., CPAs — CPA firms are high-value targets in 2026 because they hold tax records, PII, and financial data for hundreds of downstream clients. A single CPA compromise yields extortion leverage plus resaleable identity data.
• Manufacturing: Design-Aire Engineering — small engineering/manufacturing firms carry CAD files, IP, and OT-adjacent networks, and historically pay quickly to restore operations.
• Hospitality: Furnished Quarters — corporate housing/hospitality firms hold guest PII and payment-adjacent data.
• Undisclosed: The Liberty Group — sector unconfirmed; treat as pending attribution.

Geographic Concentration

100% United States. This is a deliberate US-focused campaign, consistent with gangs that calibrate ransom pricing to US insurance and legal exposure dynamics.

Victim Profile

All four organizations fit the SMB-to-mid-market band (roughly 20–500 employees, $5M–$150M annual revenue) — the sweet spot for double-extortion economics: large enough to pay six/seven figures, small enough to lack 24/7 SOC coverage and EDR maturity.

Posting Frequency & Escalation

Four same-day postings is a burst disclosure pattern. Two interpretations:

1. Batch negotiation collapse — multiple victims refused to pay within their timers and were published simultaneously.
2. Demonstration of capacity — a smaller crew signaling operational tempo to attract affiliates or intimidate current negotiations.

Either way: defenders in these sectors should assume active intrusion attempts are ongoing right now, not historical.

CVE / Initial Access Correlation

The following CISA KEV entries (confirmed ransomware use) map directly to this victim profile and should be treated as candidate initial access vectors:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): Edge VPN auth bypass — the single most likely entry point into small US firms running Check Point perimeter appliances.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal: RMM exploitation; CPA firms and small manufacturers are overwhelmingly MSP-managed, making ScreenConnect a direct pipeline into this exact victim demographic.
• CVE-2025-60710 — Windows link-following privilege escalation: Post-exploitation privesc after initial foothold.
• CVE-2023-21529 — Exchange Server deserialization: On-prem Exchange remains common in small professional services firms; authenticated RCE for lateral expansion and mailbox exfiltration.
• CVE-2026-48027 — Nx Console embedded malicious code: Supply-chain/developer-tooling vector; relevant to engineering firms like Design-Aire with in-house dev tooling.

Assessment: Patch Check Point gateways and ScreenConnect instances today. These two CVEs alone explain the majority of intrusions matching this victimology.

Detection Engineering

Sigma Rules

---
title: VPN Edge Device Anomalous Authentication Followed by Internal Recon
description: Detects successful VPN logins from unusual geographies or ASNs followed by rapid internal discovery activity — consistent with DARK PROJECT initial access via exploited perimeter appliances (e.g., CVE-2026-50751)
id: 8f3a1c2e-7b4d-4e1a-9c6f-2d5b8a1e3f01
status: experimental
date: 2026/08/25
author: Security Arsenal Threat Intelligence
logsource:
  category: firewall
  product: checkpoint
  definition: VPN authentication events
detection:
  selection_login:
    action: 'accept'
    service: 'VPN-1 & FireWall-1'
  filter_common_sources:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_login and not filter_common_sources
falsepositives:
  - Traveling executives on hotel networks
  - MSP remote administration
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: Suspicious RMM Tool Execution Outside Approved Software Inventory
description: Detects execution of remote access tooling (ScreenConnect, AnyDesk, TeamViewer, Atera) commonly abused by DARK PROJECT affiliates for persistence and lateral movement after exploitation of CVE-2024-1708 or phishing delivery
id: 1b7e4d9a-3c2f-4a8b-b5d1-6e9c0a2f7d02
status: experimental
date: 2026/08/25
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer_Service.exe'
      - '\AteraAgent.exe'
      - '\SplashtopSOS.exe'
  selection_cmd:
    CommandLine|contains:
      - 'screenconnect'
      - 'anydesk --install'
      - '/silent'
  condition: 1 of selection_*
falsepositives:
  - Legitimate MSP tooling — whitelist your approved RMM signer hashes and paths
level: medium
tags:
  - attack.command_and_control
  - attack.t1219
---
title: Pre-Encryption Staging - Shadow Copy Deletion and Mass Archive Creation
description: Detects the classic pre-detonation sequence used by DARK PROJECT and peer crews - vssadmin/wmic shadow deletion combined with mass 7-Zip/RAR archive creation indicating data staging for double extortion
id: 4c9f2a8d-1e6b-4f3a-8d7c-5a0b3e9f6103
status: experimental
date: 2026/08/25
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set {default} recoveryenabled no'
      - 'wbadmin delete catalog'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a -t7z'
      - ' a -r -p'
      - ' a -v'
  timeframe: 10m
  condition: selection_vss or selection_archive
falsepositives:
  - Backup administrators running VSS maintenance
  - Legitimate software packaging workflows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

KQL — Microsoft Sentinel Hunt: Lateral Movement & Pre-Ransomware Staging

// DARK PROJECT hunt: PsExec/WMI lateral movement + pre-encryption staging
// Run over last 14 days; tune exclusions to your admin accounts and jump hosts
let Lookback = 14d;
let SuspiciousAdmins = dynamic(["psexec", "paexec", "remcom"]);
let LateralMovement =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName =~ "services.exe"
        or (FileName =~ "wmiprvse.exe" and InitiatingProcessFileName !in~ ("svchost.exe", "wmiprvse.exe"))
    | where ProcessCommandLine has_any (SuspiciousAdmins)
        or ProcessCommandLine has "\\ADMIN$"
        or InitiatingProcessCommandLine has "//"
    | project LateralTime = Timestamp, DeviceName, AccountName,
              FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId;
let Staging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any (
        "vssadmin delete shadows", "wmic shadowcopy delete",
        "bcdedit", "wbadmin delete catalog")
       or (FileName in~ ("7z.exe", "rar.exe", "winrar.exe")
           and ProcessCommandLine has_any (" a ", "-p", "-v"))
    | project StageTime = Timestamp, DeviceName, AccountName,
              FileName, ProcessCommandLine, ReportId;
let OutboundExfil =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemotePort in (21, 22, 443, 993, 4444)
    | where InitiatingProcessFileName in~ ("rclone.exe", "megasync.exe", "filezilla.exe", "winscp.exe", "pscp.exe")
    | project ExfilTime = Timestamp, DeviceName, InitiatingProcessFileName,
              RemoteIP, RemotePort, RemoteUrl;
LateralMovement
| join kind=leftouter Staging on DeviceName
| join kind=leftouter OutboundExfil on DeviceName
| project DeviceName, AccountName, LateralTime, ProcessCommandLine,
          StageTime, ProcessCommandLine1, ExfilTime, RemoteIP, RemoteUrl
| sort by DeviceName asc, LateralTime asc

PowerShell — Rapid Response Triage Script

# DARK PROJECT Rapid Triage - run on suspected hosts or fleet-wide via EDR/Intune
# Checks: exposed RDP, new scheduled tasks (7d), shadow copy state, suspicious RMM, recent admin logons
Write-Host "=== [1/5] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
Write-Host ("RDP Enabled: {0} | NLA Enabled: {1}" -f ($rdp.fDenyTSConnections -eq 0), ($nla.UserAuthentication -eq 1))
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress, OwningProcess

Write-Host "=== [2/5] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) -and $_.TaskPath -notlike '*Microsoft*'
} | Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "=== [3/5] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies present - possible vssadmin deletion (T1490)" -ForegroundColor Red }
else { $shadows | Select-Object ID, InstallDate, VolumeName }
vssadmin list shadows 2>&1 | Select-String -Pattern 'No items found' | ForEach-Object { Write-Host $_.Line -ForegroundColor Red }

Write-Host "=== [4/5] Suspicious RMM / Exfil Tooling ===" -ForegroundColor Cyan
$tools = 'ScreenConnect','AnyDesk','TeamViewer','Atera','Splashtop','rclone','megasync','winscp','filezilla'
Get-CimInstance Win32_Process | Where-Object {
    $n = $_.Name; $tools | Where-Object { $n -like "*$_*" }
} | Select-Object ProcessId, Name, CommandLine, CreationDate

Write-Host "=== [5/5] Recent Privileged Logons (Type 2/10, last 72h) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-72)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'Logon Type:\s+(2|10)' } |
ForEach-Object {
    [pscustomobject]@{
        Time   = $_.TimeCreated
        User   = ($_.Message -split "`n" | Select-String 'Account Name:' | Select-Object -First 1).ToString().Split(':')[-1].Trim()
        Source = ($_.Message -split "`n" | Select-String 'Source Network Address:').ToString().Split(':')[-1].Trim()
    }
} | Sort-Object Time -Descending | Format-Table -AutoSize

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. VSS deletion events — vssadmin delete shadows, wmic shadowcopy delete, or bcdedit recovery-disabled changes on any server. This is the 30-minute warning shot.
2. Mass archive creation — 7-Zip/RAR running at scale against file shares, especially with password flags (-p).
3. Bulk outbound transfer tooling — rclone, MEGAsync, WinSCP, FileZilla processes on servers that have no business running them.
4. New local/domain admin accounts created outside change windows, or dormant accounts suddenly active.
5. PsExec/service-based execution fanning out from a single workstation — the "patient zero spreading" signature.
6. AV/EDR tampering — service stop attempts, sensor uninstalls, or exclusion additions in Defender.
7. Unusual VPN session geography — successful perimeter auth from ASN/geography mismatches, particularly on Check Point gateways pending CVE-2026-50751 patching.

Critical Assets DARK PROJECT Prioritizes for Exfiltration

• Accounting/tax data (CPA targeting is explicit in this wave): tax software databases, client PII, W-2s, financial statements.
• Engineering IP: CAD files, project drawings, bid documents.
• Guest/client PII in hospitality systems: reservation databases, identity documents.
• Email archives from on-prem Exchange (CVE-2023-21529 path) for negotiation leverage and future phishing.
• Backup infrastructure credentials — expect targeting of Veeam/backup consoles early to disable recovery.

Containment Actions — Ordered by Urgency

1. Isolate, don't power off — network-quarantine suspected hosts via EDR to preserve memory artifacts.
2. Kill perimeter exposure — force-reset all VPN credentials, disable compromised edge appliance accounts, block attacker infrastructure at the firewall.
3. Disable RMM tooling outside your approved stack across the fleet immediately.
4. Rotate domain admin and service account credentials — assume krbtgt compromise if DCs were touched; plan a double-reset.
5. Protect backups — take backup infrastructure offline from the production network; verify immutable/offline copies before any restore decision.
6. Engage IR counsel and check notification obligations — CPA and hospitality victims carry state breach-notification duties for client PII.

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateways for CVE-2026-50751 (IKEv1 improper auth) or disable IKEv1 as an interim compensating control.
• Patch/upgrade ConnectWise ScreenConnect to a version remediating CVE-2024-1708; audit for rogue ScreenConnect clients fleet-wide.
• Enforce MFA on all remote access — VPN, RDP gateways, RMM consoles, and MSP tooling. No exceptions for service accounts.
• Block RDP at the perimeter (TCP/3389); require VPN + NLA for any internal RDP.
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days — assume you are already in someone's dwell window.
• Verify shadow copies exist on file servers and that backup immutability is actually enabled, not just licensed.

Short-Term (2 Weeks)

• Segment backup infrastructure onto an isolated management network with its own credentials — no shared domain trust with production.
• Application control for RMM — allowlist only your sanctioned remote management tooling by signer hash; block everything else by policy (WDAC/AppLocker).
• Egress filtering and exfil detection — alert on rclone-class tooling and large outbound transfers from servers; most mid-market networks have zero egress visibility.
• MSP access governance — if you're an SMB using an MSP (as most of these victims were), contractually require MFA, patching SLAs, and incident notification terms. Your MSP's ScreenConnect instance is your attack surface.
• Decommission or migrate on-prem Exchange — CVE-2023-21529-class deserialization bugs keep recycling through ransomware playbooks.
• Tabletop a double-extortion scenario — legal, comms, and leadership need a pre-agreed decision framework before a leak-site timer starts counting down.

Assessment

DARK PROJECT is a low-volume, high-selectivity crew executing a US-focused, mid-market double-extortion campaign with a current appetite for professional services, hospitality, and engineering/manufacturing targets. The single-day, four-victim burst suggests active negotiations failed simultaneously — meaning the intrusions behind these posts happened weeks ago, and the next wave is already inside someone else's network right now. Organizations matching this victim profile should treat the Check Point and ScreenConnect KEVs as emergencies, hunt for pre-encryption staging indicators today, and validate backup recoverability before they need it.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub