Dark Project Ransomware Group Offers Hackers 80% Cut of Extortion Payments

A ransomware group is offering hackers an 80% share of extortion payments in a bid to attract affiliates and expand its operations.

Known as Dark Project, the ransomware-as-a-service (RaaS) operation was first observed in June 2026 and reportedly handles victim negotiations on behalf of its affiliates. According to threat intelligence firm Gurucul, the group's public leak site lists 38 alleged victims across eight countries.

The arrangement allows affiliates to focus on carrying out attacks while Dark Project handles negotiations and payment processing. For organizations, the model illustrates how ransomware operators are attempting to make attacks easier to coordinate and scale.

Inside the 80/20 ransomware business model

Dark Project uses a double-extortion strategy: affiliates exfiltrate sensitive files before encrypting local networks, using the threat of public disclosure as financial leverage.

Under the advertised partner program, Dark Project operators retain a 20% cut for infrastructure, reporting, and victim negotiations, passing the remaining 80% to affiliates. Recruitment and operations follow a four-stage workflow:

• Application: Prospective criminal partners contact operators via the Tox messaging protocol.
• Onboarding: Approved affiliates receive unique partner IDs, operational playbooks, and platform access.
• Deployment: Hackers deploy payloads via provided Windows assessment agents (EXE and BIN formats) and social-engineering suites.
• Settlement: The core group manages ransom negotiations, promising Bitcoin (BTC) commission payouts to affiliates within 24 hours of settlement.

The RaaS shift: Friction reduction as a weapon

Dark Project’s aggressive 80% payout reflects a shifting cybercrime economy. As international law enforcement crackdowns disrupt legacy ransomware operators, newer syndicates compete aggressively for skilled intrusion talent by minimizing affiliate friction.

By centralizing victim communication, leak hosting, and negotiations, Dark Project lets technical affiliates focus exclusively on initial access and lateral movement. 

However, defenders should note an operational gap: the group’s platform claims and advertised payment schedules remain unverified by third-party transaction tracing, and public leak-site postings often serve as self-promotional marketing tools rather than proof of complete operational compromise.

What this means for organizations and end users

When RaaS operators lower entry barriers for affiliates, everyday business operations face heightened cascading risks:

• Critical operational disruption: Heavy targeting of manufacturing and healthcare risks halting physical assembly lines and disrupting patient medical services.
• Dual-layer extortion exposure: Because threat actors steal data before deployment, maintaining reliable backups solves system recovery but cannot stop proprietary customer records, corporate IP, or employee files from being auctioned online.
• Credential spreading: Dark Project actors frequently leverage info-stealer logs, exposed Remote Desktop Protocol (RDP) interfaces, and unpatched VPN gateways for initial access, putting internal enterprise credentials at immediate risk.

Organizations can reduce their exposure by enforcing phishing-resistant multifactor authentication across remote-access services, promptly patching internet-facing systems, maintaining isolated and immutable backups, and monitoring for unusual data transfers or signs of ransomware preparation.

Backups remain essential for recovery, but they cannot prevent attackers from threatening to release stolen information. That makes early detection of unauthorized access and data exfiltration just as important as preventing encryption.

Dark Project's advertised business model illustrates how ransomware groups can attempt to expand their reach by outsourcing attacks to affiliates. For defenders, the priority remains limiting the access and opportunities those affiliates need to compromise enterprise networks.

As the holiday shopping season approaches, cybersecurity experts are warning retailers and consumers about rising fraud risks involving fake refund requests and gift card scams, which can lead to financial losses and stolen customer information.