Classification: TLP:CLEAR | Publication Date: 2026-11-15 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

DARK PROJECT Ransomware Gang: 3 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-11-10 and 2026-11-13, the DARK PROJECT ransomware operation published three new listings on its dark web leak site, naming organizations in Canada, the United States, and the United Arab Emirates across healthcare and manufacturing verticals. Every listing in this batch is single-source — observed by one crawler only, with no independent second-crawler confirmation that the postings even exist on the gang's infrastructure. None of this confirms a breach occurred; these are unverified claims by a criminal actor. However, DARK PROJECT's historical pattern of following through on leak-site publication with data release makes any listing on their site operationally significant for defenders. This briefing translates those claims into detection content, hunting queries, and prioritized hardening actions for security teams in the affected sectors and geographies.

Named on the leak site in this batch:

Sourcing & Verification

This briefing is built on leak-site monitoring data, and the provenance matters. Zero of the three listings above were independently observed by a second leak-site crawler; all three appear on a single source (ransomware.live) only. That means we cannot even confirm the postings exist on DARK PROJECT's infrastructure as of publication — let alone that the underlying claims are true.

Inclusion in this briefing reflects the threat actor's claim, and nothing more. A leak-site listing is an accusation by a criminal enterprise, not a confirmed breach. No corroboration tier in our data — including multi-source — confirms that any organization suffered an intrusion; only the organization itself or its regulator can do that.

A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question. We deliberately avoid language implying any named organization "was breached," "was attacked," or "is managing an incident."

Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — DARK PROJECT

Aliases and attribution. DARK PROJECT operates under a single primary brand with no widely documented aliases in open-source reporting as of this writing. The operation maintains a dedicated leak site (DLS) on Tor and follows the standard name-and-shame playbook: victims are listed with a countdown, sample data is teased, and full dumps follow if demands are not met.

Operating model. DARK PROJECT exhibits characteristics of a semi-closed ransomware-as-a-service (RaaS) operation: a small core team controls the encryptor, negotiation, and leak-site infrastructure, while a limited set of vetted affiliates handles initial access and deployment. This structure produces lower victim volume than open RaaS programs but higher operational consistency — tooling, ransom-note formatting, and negotiation behavior are relatively stable across intrusions.

Ransom demands. Observed demands cluster in the mid-five to low-seven figures (USD, denominated in Monero or Bitcoin), scaled to the victim's perceived revenue and the sensitivity of exfiltrated data. Healthcare and critical-manufacturing victims historically draw the upper end of that range.

Initial access methods. DARK PROJECT's known access mix, in rough order of frequency:

1. Exploitation of internet-facing edge services — VPN concentrators, firewalls, and remote access gateways with known vulnerabilities or weak authentication.
2. Phishing with macro-enabled documents or malicious attachments, leading to loader deployment (commonly Cobalt Strike or similar C2).
3. RDP exposure — brute-forced or credential-stuffed externally facing RDP, frequently sourced from initial access brokers.
4. Compromised valid accounts, including credentials harvested from infostealer logs purchased on underground markets.

Extortion model. Double extortion is standard: data is staged and exfiltrated before encryption, and the leak-site publication typically occurs 24–96 hours after failed or stalled negotiations. The group has demonstrated willingness to publish partial data as pressure escalates.

Dwell time. Observed dwell time from initial access to detonation ranges from roughly 4 to 14 days, with the data-theft phase usually occupying the final 48–72 hours. This window is the defender's best opportunity — every detection rule in this briefing targets activity that occurs before encryption fires.

Current Campaign Analysis

Sectors Targeted

The current batch skews toward sectors where operational disruption creates maximum pressure to pay:

• Healthcare — Bear Valley Community Hospital (US). Community-scale healthcare providers hold high-value PII/PHI and have historically low tolerance for downtime, making them perennial ransomware targets.
• Manufacturing — MTM&O Gold Refinery DMCC (AE). Precious-metals refining combines intellectual property, supply-chain leverage, and — given the commodity involved — potentially sensitive client and assay data.
• One listing with unclassified sector — The CCMC (CA). The sector tag is absent from the source data; we do not speculate.

Geographic Concentration

The batch spans three countries — Canada, the United States, and the UAE — consistent with DARK PROJECT's opportunistic rather than geographically focused targeting. The AE listing is notable: Middle East manufacturing and commodities targets appear with increasing frequency across the broader ransomware ecosystem through 2026, reflecting both expanding affiliate access networks and the region's high perceived payment capacity.

Victim Profile

Based on the named organizations' sectors, the profile skews toward small-to-mid-size enterprises — community-scale healthcare providers and specialized industrial firms. These organizations typically carry meaningful revenue (tens of millions USD annually) but often lack mature SOC coverage, 24/7 monitoring, or segmented OT/IT environments. This matches DARK PROJECT's historical preference for victims large enough to pay five-to-six-figure ransoms but under-resourced enough to be compromised via commodity access methods. We make no claim about any specific named organization's actual revenue or security posture.

Posting Frequency and Escalation

Three listings within a four-day window (2026-11-10 through 2026-11-13) represents a modest but real uptick for an operation of DARK PROJECT's typical cadence. The two same-day postings (2026-11-10) followed by a third three days later is consistent with either a single affiliate working a pipeline of pre-staged victims, or batch publication of victims whose negotiation windows expired concurrently. Defenders should treat a listing date as trailing evidence: the intrusion — if the claim is real — likely began days to weeks earlier.

CVE Exposure — Hypothesis, Not Attribution

We have no evidence linking any specific CVE to any specific named listing above. However, DARK PROJECT's documented reliance on edge-service exploitation makes the following CISA KEV entries — all confirmed as ransomware-exploited — directly relevant as sector-level exposure hypotheses for organizations matching this campaign's victim profile:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1 key exchange) — added to KEV 2026-06-08. Edge VPN/firewall compromise is a top DARK PROJECT access vector; any internet-facing Check Point gateway should be treated as a priority-one patching target.
• CVE-2026-20316 (Cisco Secure Firewall Management Center, hard-coded password) — added to KEV 2026-07-29. Compromised management planes give attackers persistent, stealthy control over network security policy itself.
• CVE-2026-59310 (VMware vCenter path traversal) — added to KEV 2026-08-18. vCenter compromise enables mass hypervisor-level encryption — the highest-impact detonation scenario for any ransomware crew.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — added to KEV 2026-08-05. CI/CD compromise enables supply-chain-style lateral movement and credential theft from build agents — particularly relevant to manufacturing and technology-adjacent victims.
• CVE-2026-48027 (Nx Console embedded malicious code) — added to KEV 2026-05-27. A supply-chain vector affecting developer tooling; relevant where build environments bridge into production networks.

The defensive takeaway: organizations in healthcare, manufacturing, and adjacent sectors should treat every item on this list as patch-now, regardless of whether they believe they are a DARK PROJECT target. KEV-listed vulnerabilities with confirmed ransomware use are load-bearing access vectors across the entire criminal ecosystem.

Detection Engineering

The following detections target DARK PROJECT's known playbook: edge/VPN exploitation, phishing-driven loader execution, RDP-based access, PsExec/WMI lateral movement, and pre-encryption data staging. Tune thresholds to your environment baseline.

---
title: DARK PROJECT - Suspicious RAR/7z Data Staging Before Exfiltration
id: 9f3a1c2e-d4b5-4f6a-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects mass compression of files into archives in user or temp directories, a hallmark of pre-exfiltration data staging observed in DARK PROJECT intrusions. Ransomware operators typically compress stolen data with rar.exe/7z.exe before exfiltration via Rclone or MEGA.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - ' -v'
      - ' -p'
      - ' -m5'
  selection_path:
    CommandLine|contains:
      - '\Users\'
      - '\Temp\'
      - '\AppData\'
      - '\ProgramData\'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - Legitimate backup operations (scope to known backup service accounts)
  - IT administrators archiving project data
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
---
title: DARK PROJECT - PsExec and WMI Remote Service Creation Lateral Movement
id: 7b2e4d1a-3c5f-4e6b-9a8d-2f1e3d4c5b6a
status: experimental
description: Detects remote service creation events (7045) consistent with PsExec-style lateral movement and WMI remote process execution, both staples of DARK PROJECT's spread-and-stage phase before ransomware detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/15
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_svc:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'remcom'
    ImagePath|contains:
      - 'ADMIN$'
      - '\Windows\PSEXESVC'
      - '%COMSPEC%'
  condition: selection_event and selection_svc
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ, manageengine) — whitelist known deployment service names and source hosts
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
---
title: DARK PROJECT - Edge VPN and Firewall Anomalous Authentication Followed by Internal RDP
id: 3c8f1a9d-2b4e-4f5a-9c6d-7e8f9a0b1c2d
status: experimental
description: Detects inbound RDP (4624 Type 10) originating from VPN-assigned address ranges or immediately following VPN logon, consistent with edge-device exploitation (e.g., CVE-2026-50751, CVE-2026-20316 class access) pivoting to internal RDP — a documented DARK PROJECT initial access chain.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/15
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 10
  filter_known_admins:
    TargetUserName|endswith: '$'
  timeframe_outside_hours:
    # Fire on remote interactive logons outside business hours or from non-standard source IPs
    # Tune to your environment's approved admin source ranges
    IpAddress|startswith:
      - '10.99.'   # example: VPN pool range — replace with yours
      - '172.31.'  # example: secondary VPN pool — replace with yours
  condition: selection and timeframe_outside_hours and not filter_known_admins
falsepositives:
  - On-call administrators working off-hours via VPN — correlate with VPN gateway logs and change tickets
level: medium
tags:
  - attack.initial-access
  - attack.t1133
  - attack.t1021.001

The following Microsoft Sentinel hunt query identifies pre-ransomware staging behavior associated with this group's toolset — looking for hosts that show the compressed-archive staging pattern plus outbound transfer tooling (Rclone/MEGA-style) plus shadow-copy tampering within a correlated window. Any single hit warrants investigation; a host matching all three legs should be treated as a likely active intrusion.

// DARK PROJECT pre-ransomware staging hunt — Microsoft Sentinel
// Correlates archive staging, exfil tooling, and VSS tampering per device over 7 days
let Lookback = 7d;
let ArchiveStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" -r", " -v", " -p", " a ")
    | summarize ArchiveCmds = make_set(ProcessCommandLine, 10), ArchiveCount = count()
      by DeviceId, DeviceName, bin(TimeGenerated, 1h);
let ExfilTooling =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rclone.exe", "megacmd.exe", "MEGAcmd.exe", "winscp.exe", "filezilla.exe", "curl.exe")
       or ProcessCommandLine has_any ("rclone", "mega.nz", "transfer.sh", "anonfiles", "gofile")
    | summarize ExfilCmds = make_set(ProcessCommandLine, 10), ExfilCount = count()
      by DeviceId, bin(TimeGenerated, 1h);
let VSSTampering =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
       or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "bootstatuspolicy ignoreallfailures"))
       or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
    | summarize VSSCmds = make_set(ProcessCommandLine, 10)
      by DeviceId;
ArchiveStaging
| join kind=inner ExfilTooling on DeviceId
| join kind=leftouter VSSTampering on DeviceId
| extend RiskScore = 40 + (iif(isnotempty(VSSCmds), 60, 0)) + ArchiveCount + ExfilCount
| project DeviceName, ArchiveCount, ExfilCount, VSSCmds, ArchiveCmds, ExfilCmds, RiskScore
| order by RiskScore desc;

The following PowerShell script gives incident responders a rapid first-pass triage: it surfaces scheduled tasks created in the last 7 days (a common DARK PROJECT persistence and deployment mechanism), checks Volume Shadow Copy health and recent deletion evidence, and flags externally exposed RDP. Run elevated on any host suspected of involvement.

# DARK PROJECT Rapid Triage — run elevated on suspect hosts
# Outputs: new scheduled tasks (7d), VSS state, RDP exposure, suspicious recent services
$cutoff = (Get-Date).AddDays(-7)
$report = [ordered]@{}

Write-Host "[*] Scheduled tasks created/modified in last 7 days..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TaskName   = $_.TaskName
        TaskPath   = $_.TaskPath
        Author     = $_.Author
        Action     = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
        LastRun    = $info.LastRunTime
    }
} | Where-Object { $_.LastRun -gt $cutoff -and $_.TaskPath -notlike '\Microsoft\*' }
$report['RecentTasks'] = $tasks
$tasks | Format-Table -AutoSize

Write-Host "[*] Volume Shadow Copy status..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report['ShadowCopiesPresent'] = [bool]$shadows
if (-not $shadows) {
    Write-Host "[!] NO shadow copies present — possible vssadmin deletion (pre-encryption behavior)" -ForegroundColor Red
}
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'VSS|Volume Shadow' }
$report['VSSEvents'] = $vssEvents.Count

Write-Host "[*] RDP exposure check..." -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$report['RDPEnabled'] = $rdpEnabled
$report['RDPPort'] = $rdpPort
$report['NLAEnabled'] = ($nla -eq 1)
if ($rdpEnabled -and $nla -ne 1) {
    Write-Host "[!] RDP enabled WITHOUT NLA — high-risk brute-force surface" -ForegroundColor Red
}

Write-Host "[*] Services installed in last 7 days (PsExec-class lateral movement artifact)..." -ForegroundColor Cyan
$newSvcs = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message
$report['NewServices7045'] = $newSvcs
$newSvcs | Format-List

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\darkproject_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').json"
Write-Host "[+] Triage report written to $env:TEMP" -ForegroundColor Green

Incident Response Priorities

DARK PROJECT's playbook creates a predictable pre-detonation window. Priorities below assume you have detected staging activity or learned your organization appears on their leak site.

T-Minus Detection Checklist (Before Encryption Fires)

• Mass archive creation (rar/7z) on file servers, NAS, or executive/finance endpoints
• Rclone, MEGAcmd, or unusual outbound transfer tooling in process telemetry or proxy logs
• vssadmin delete shadows, bcdedit recoveryenabled no, or wmic shadowcopy delete execution
• New 7045 service-install events naming PSEXESVC-like services or binaries in ADMIN$
• Scheduled tasks created outside change windows, especially SYSTEM-context tasks invoking scripts from ProgramData or user profiles
• VPN/firewall authentication anomalies: logons from impossible geographies, off-hours admin access, or sessions matching no change ticket — particularly on appliances in the CVE-2026-50751 / CVE-2026-20316 exposure class
• Cobalt Strike-style beaconing: periodic small HTTPS posts to low-reputation domains, or named-pipe activity flagged by EDR
• DCSync-style directory replication from non-DC hosts (a sign of domain dominance preceding mass deployment)

Assets This Gang Historically Prioritizes for Exfiltration

• Patient/customer PII and PHI (healthcare victims) — maximum regulatory and reputational leverage
• Financial records, payroll, and banking details — universal pressure material
• Contracts, assay/quality data, and client lists (industrial/refining victims) — commercially sensitive and disclosure-averse
• Email archives of executive and legal accounts — negotiation intelligence and secondary extortion material
• Backup catalogs and infrastructure documentation — used to plan encryption targeting and sabotage recovery

Containment Actions, Ordered by Urgency

1. Isolate, don't nuke: Network-contain hosts showing staging/exfil behavior via EDR or switch quarantine. Do not power off — preserve memory for forensics.
2. Cut the egress: Block known exfil destinations (rclone endpoints, MEGA, anonfiles-class services) at the proxy/firewall; force all outbound through authenticated inspection.
3. Disable compromised credentials: Force reset for any account observed in suspicious logons; revoke active VPN sessions and tokens enterprise-wide if edge-device compromise is suspected.
4. Protect the backup plane: Take backup infrastructure off the network path reachable from production credentials; verify at least one immutable/offline copy predates the earliest suspicious activity.
5. Preserve evidence: Capture volatile data, EDR timelines, VPN/firewall logs, and email gateway logs before rolling retention erases them.
6. Engage response support: Activate your IR retainer, counsel, and cyber-insurance carrier early — do not wait for detonation or a ransom note.
7. Do not contact the threat actor from corporate infrastructure; any negotiation engagement should run through your IR firm and counsel.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate every KEV item in this briefing's exposure class on internet-facing assets: Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077). If patching is not immediately possible, restrict management interfaces to allow-listed admin networks.
• Enforce MFA on all remote access — VPN, RDP gateways, webmail, and admin portals — with no service-account exceptions. Credential-based access is DARK PROJECT's cheapest entry point.
• Kill external RDP: No host should expose 3389 to the internet. Audit with external scanning today, not this sprint.
• Block macro execution from internet-sourced Office documents (Mark-of-the-Web enforcement) and deploy attack surface reduction rules for Office child processes.
• Deploy the Sigma rules and KQL query above to your SIEM/EDR and run the triage script against your highest-value servers (file, backup, and identity infrastructure first).
• Alert on vssadmin/bcdedit/wmic shadow operations from any non-backup-software context — treat as page-worthy.

Short-Term (Two Weeks)

• Segment aggressively: Isolate backup infrastructure, healthcare/clinical systems, and OT/manufacturing networks from general IT with deny-by-default east-west rules. DARK PROJECT's impact scales with flat networks.
• Implement egress filtering with categorization: Deny direct outbound from servers; alert on connections to file-sharing and anonymous-upload services.
• Deploy tiered administration: Dedicated privileged access workstations and separate admin credentials prevent the credential-theft-to-domain-dominance chain this playbook depends on.
• Immutable backups with tested restoration: At least one copy offline or logically air-gapped, with restoration time actually measured — attackers specifically hunt and destroy reachable backups before detonation.
• EDR coverage audit: Close gaps on servers, hypervisors, and network appliances; ransomware crews deliberately target management planes (vCenter, backup consoles) that sit outside endpoint coverage.
• Tabletop the leak-site scenario: Exercise the decision tree for appearing on a criminal's leak site — legal, comms, regulatory notification analysis, and IR escalation — before you need it.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub