[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBy9DgEMRsr3SeTrdpnVSmXVxdDNelg6VvcQlqITsdLs":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"d4e27f91-b4ba-4e6b-b6c4-496c78418912","New Dark Project Ransomware Group Offers Hackers 80% Commission to Expand Cyberattacks","new-dark-project-ransomware-group-offers-hackers-80-commission-to-expand-cyberat-480af1","A ransomware group called Dark Project is recruiting criminal partners with an offer of 80% of proceeds from successful attacks, pairing generous commissions with a platform for managing extortion. First observed in June 2026, the financially motivated operation combines data theft, file encryption, and public leak threats to pressure organizations into paying. The group’s published […] The post New Dark Project Ransomware Group Offers Hackers 80% Commission to Expand Cyberattacks appeared first on Cyber Security News.","A new ransomware group named Dark Project is actively recruiting affiliates by offering an 80% commission on successful attacks and providing a platform for managing extortion. First observed in June 2026, the group employs a double-extortion model, combining data theft and encryption with threats of public data leaks. Researchers have identified their recruitment process, infrastructure, and attack methods, noting a significant number of victims across multiple countries, with the United States being heavily targeted.","Dark Project ransomware group recruits hackers with 80% commission offer and extortion platform.","https:\u002F\u002Fcybersecuritynews.com\u002Fnew-dark-project-ransomware-group\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FNew-Dark-Project-Ransomware-Group-Offers-Hackers-80-Commission-to-Expand-Cyberattacks.webp","2026-11-06T15:03:03+00:00","2026-11-06T16:00:29.192186+00:00",8,[17,20],{"name":18,"type":19},"Dark Project","threat_actor",{"name":21,"type":22},"Gurucul","vendor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":49,"vendors":136},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":45,"name":80,"problem":81,"products":82},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":108,"name":109,"problem":110,"products":111},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"dark-project-ransomware-lures-affiliates-with-80-cut-targeting-us-organizations","Dark Project Ransomware Lures Affiliates with 80% Cut, Targeting US Organizations","The Dark Project ransomware group demonstrates how the Ransomware-as-a-Service (RaaS) model dramatically lowers the barrier to entry for cybercriminals by offering lucrative commissions and ready-made attack infrastructure. By combining data theft with encryption (double extortion), attackers gain two leverage points — victims must pay not just to restore systems but also to prevent sensitive data from being publicly leaked. This industrialized approach means organizations now face threats from a rapidly expanding pool of less-skilled but well-equipped affiliates. The heavy targeting of US organizations underscores that no sector is too small or too large to be a victim, and defenders must assume compromise is a matter of when, not if.",[142,143,144,145,146,147,148],"CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":150,"NIS2 Article 21(2)(b)":151,"MITRE ATT&CK T1566: Phishing":152,"CIS Control 17: Incident Response Management":153,"CIS Control 14: Security Awareness and Skills Training":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"The double-extortion model involves exfiltration of personal data, triggering GDPR obligations; organizations must implement technical measures to protect personal data from unauthorized disclosure and have breach notification processes ready.","NIS2 explicitly requires incident handling capabilities and business continuity measures, both of which are critical for surviving a double-extortion ransomware attack from groups like Dark Project without paying the ransom.","Phishing is the predominant initial access vector for RaaS affiliate campaigns like Dark Project, making anti-phishing controls and user training directly relevant to stopping this threat at the entry point.","A mature incident response plan with ransomware-specific playbooks enables organizations to contain Dark Project affiliate attacks quickly, limiting the window for both data exfiltration and encryption.","RaaS affiliates commonly gain initial access via phishing; a well-trained workforce that recognizes and reports suspicious emails reduces the likelihood of a successful foothold.","Affiliates often exploit unpatched vulnerabilities for initial access or privilege escalation; systematic vulnerability management reduces the attack surface available to Dark Project recruits.","Restricting affiliate access through strong identity controls and least-privilege principles directly limits how far an attacker can move after initial compromise, reducing data theft and encryption scope."]