DARK PROJECT Ransomware Gang: 3 New Victims Posted — Energy, Transportation & Automotive Targeting Analysis With Detection Rules

---
title: DARK PROJECT - Check Point VPN Anomalous Authentication Followed by Internal Connection
id: a7f3c1d2-8e4b-4a1f-9c2d-darkproject01
status: experimental
description: Detects successful VPN authentication from unusual source geography followed by internal RDP/SMB connection attempts within a short window, consistent with DARK PROJECT edge-device initial access (CVE-2026-50751 pattern)
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: authentication
    product: checkpoint
    service: vpn
detection:
    selection:
        action: 'accept'
        protocol: 'IKEv1'
    filter_known_good:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_known_good
fields:
    - src_ip
    - user
    - auth_method
timeframe: 30m
falsepositives:
    - Legitimate remote workforce from new locations
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1133
---
title: DARK PROJECT - Pre-Encryption Staging via PsExec, WMI, and Mass File Renaming
id: b8e4d2f3-9a5c-4b2e-8d3f-darkproject02
status: experimental
description: Detects PsExec/WMI remote execution combined with vssadmin shadow copy deletion or mass file extension changes — hallmark DARK PROJECT pre-detonation behavior
author: Security Arsenal Threat Intelligence
date: 2026/08/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_lateral:
        Image|endswith:
            - '\psexec.exe'
            - '\psexesvc.exe'
            - '\wmic.exe'
    selection_shadow:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
    selection_rclone:
        Image|endswith:
            - '\rclone.exe'
            - '\megacmd.exe'
            - '\filezilla.exe'
    condition: 1 of selection_*
timeframe: 15m
falsepositives:
    - Legitimate administrative tooling (allowlist by service account and source host)
level: critical
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.impact
    - attack.t1490
    - attack.exfiltration
---
title: DARK PROJECT - ScreenConnect or Suspicious RMM Execution Outside Approved Path
id: c9f5e3a4-0b6d-4c3f-7e4a-darkproject03
status: experimental
description: Detects execution of remote access tooling (ScreenConnect, AnyDesk, TeamViewer) from non-standard paths — consistent with DARK PROJECT persistence via abused RMM software (CVE-2024-1708 exploitation follow-on)
author: Security Arsenal Threat Intelligence
date: 2026/08/07
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\screenconnect.clientservice.exe'
            - '\anydesk.exe'
            - '\teamviewer.exe'
            - '\screenconnect.windowsclient.exe'
    filter_approved:
        Image|startswith:
            - 'C:\Program Files\ScreenConnect'
            - 'C:\Program Files\ConnectWise'
            - 'C:\Program Files (x86)\ScreenConnect'
    condition: selection and not filter_approved
falsepositives:
    - Portable RMM deployments by helpdesk (validate and allowlist)
level: high
tags:
    - attack.persistence
    - attack.command_and_control
    - attack.t1219

// DARK PROJECT Hunt: Pre-detonation staging indicators
// Looks for shadow copy deletion, mass file renames, RMM tool anomalies, and
// unusual outbound transfer volume within a 7-day window
let lookback = 7d;
let RenamedExt = dynamic([".darkproject", ".locked", ".encrypted", ".crypt"]);
let ShadowDeletion =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "wbadmin delete catalog")
    | project ShadowTime=Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let MassRename =
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where ActionType == "FileRenamed"
    | extend NewExt = tolower(extract(@"\.([^.]+)$", 1, FileName))
    | where NewExt in~ (RenamedExt) or FileName matches regex @"\.[a-z0-9]{6,10}$"
    | summarize RenameCount = count(), FirstSeen = min(Timestamp) by DeviceName, FolderPath, InitiatingProcessFileName
    | where RenameCount > 50;
let SuspiciousRMM =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName has_any ("screenconnect", "anydesk", "teamviewer", "rclone", "megacmd")
    | where not(FolderPath has_any ("C:\\Program Files\\ScreenConnect", "C:\\Program Files\\ConnectWise"))
    | project RMMTime=Timestamp, DeviceName, FileName, FolderPath, AccountName;
let HighEgress =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemoteIPType == "Public"
    | summarize TotalBytesOut = sum(BytesSent), DistinctDests = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName
    | where TotalBytesOut > 500000000 and InitiatingProcessFileName has_any ("rclone", "7z", "winrar", "powershell");
ShadowDeletion
| join kind=leftouter MassRename on DeviceName
| join kind=leftouter SuspiciousRMM on DeviceName
| join kind=leftouter HighEgress on DeviceName
| project DeviceName, AccountName, ShadowTime, ProcessCommandLine, RenameCount, FolderPath, RMMTime, FileName, TotalBytesOut, DistinctDests
| order by ShadowTime desc

# DARK PROJECT Rapid Triage Script - run on suspected hosts or via PS remoting at scale
# Checks: recent scheduled tasks, volume shadow copy integrity, RDP exposure, suspicious RMM services
$lookback = (Get-Date).AddDays(-7)
$report = @()

Write-Host "[1] Scheduled tasks created/modified in last 7 days..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt $lookback } | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
$report += $tasks | ForEach-Object { "[TASK] $($_.TaskName) | $($_.TaskPath) | $($_.Date) | $($_.Action)" }

Write-Host "[2] Volume Shadow Copy status..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $report += "[ALERT] NO volume shadow copies present - possible pre-ransomware deletion (T1490)" }
else { $shadows | ForEach-Object { $report += "[VSS] $($_.DeviceObject) created $($_.InstallDate)" } }

Write-Host "[3] RDP exposure check..." -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report += "[RDP] Enabled=$rdpEnabled | NLA=$nla (NLA must be 1)"
if ($rdpEnabled -and $nla -ne 1) { $report += "[ALERT] RDP exposed without NLA - brute force risk" }

Write-Host "[4] Suspicious RMM services..." -ForegroundColor Cyan
$suspicious = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'screenconnect|anydesk|teamviewer|mesh|rustdesk' -and $_.PathName -notmatch 'Program Files' }
if ($suspicious) { $suspicious | ForEach-Object { $report += "[ALERT] RMM service outside approved path: $($_.Name) -> $($_.PathName)" } }
else { $report += "[RMM] No unauthorized RMM services detected" }

Write-Host "[5] Recent failed logon bursts (RDP/VPN brute force indicator)..." -ForegroundColor Cyan
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$lookback} -MaxEvents 2000 -ErrorAction SilentlyContinue | Group-Object {$_.Properties[19].Value} | Where-Object { $_.Count -gt 50 }
if ($fails) { $fails | ForEach-Object { $report += "[ALERT] $($_.Count) failed logons targeting account: $($_.Name)" } }

$report | Out-File "$env:TEMP\darkproject_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
$report | ForEach-Object { Write-Host $_ }