THREAT ACTOR
DARK-PROJECT_
ActiveDARK-PROJECT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of DARK-PROJECT, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 30
Leak site mirrors
9 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onionDark Project snapshot · 2026-09-23 03:35 -
wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd.onionHome · File index snapshot · 2026-09-22 22:00 -
7iphetz64a7iihcpwr3nirjioghyt6lrku62gu4z7f3zo7rcz5qrgvad.onionsnapshot · 2026-08-05 16:01 -
3i5px2hibsyityv6jixnqba35yz25jekbwwumjdxjqzt3euqsygjx5id.onionHome · File index snapshot · 2026-09-22 21:00 -
tjaaioz32salcoj63ttxra6nfqggwbcezkzpwnhyoiwq5tuimzmsb3qd.onionHome · File index snapshot · 2026-09-23 01:02 -
x2jz63qemhcbhyskzt3pie757oicdkctk2rh5dpykmxsw2yoayeqs5yd.onionsnapshot · 2026-09-22 22:29 -
pokttabd2hod47ladeeoin22wmq4remyo3wshwvxfuhgqygcbezq2qqd.onionHome · File index snapshot · 2026-09-23 01:00 -
2zl5qc3mqap7vziqfis65oyjcgdiedigoequxbqsn6uwian7ieozvoqd.onionHome · File index snapshot · 2026-09-23 01:11 -
t2ru74fbgut26xnagtrl4ajeh5vqytrl6cpr6cubmr6sqdxk5guh5mqd.onionHome · File index snapshot · 2026-09-23 00:19
Recent victims
The 50 most recent victims claimed by DARK-PROJECT. Total in the index: 30.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-15 | Cumar Marble & Granite | Cumar Marble & Granite, a company specializing in luxury kitchens, bat… |
| 2026-09-09 | Specchem LLC | A cyberattack on Specchem LLC resulted in a massive data breach. As a … |
| 2026-09-08 | MEI Architects | As a result of the attack, 340 GB of data (approximately 130,000 files… |
| 2026-09-07 | Alurwalls | Alurwalls was attacked, resulting in the theft of approximately 17 GB … |
| 2026-09-07 | Master Manufacturing Co., Inc. | Master Manufacturing Co specializing in custom metal stamping and prod… |
| 2026-08-25 | Dentist in New Britain, CT | As a result of the attack, the following were compromised: the entire … |
| 2026-08-25 | Pump Engineering Company | During the cyberattack, 120,000 files (115 GB) were stolen, including … |
| 2026-08-24 | Furnished Quarters | The company "Furnished Quarters" was the victim of a successful cybera… |
| 2026-08-24 | Design-Aire Engineering, INC | Design-Aire Engineering, INC has suffered a cyberattack on its servic… |
| 2026-08-24 | Jones, Little & Co., CPAs, LLP | At least 100 gigabytes of company data—including financial records, in… |
| 2026-08-24 | The Liberty Group | A company has suffered a major cyberattack resulting in the theft of a… |
| 2026-08-06 | Long-Lewis Automotive Group | Following a successful cyberattack on Long Lewis, more than 500 GB of … |
| 2026-08-05 | Thermo King | |
| 2026-08-05 | Mile Bluff Medical Center | |
| 2026-08-05 | Ohio Living Home Health & Hospice | |
| 2026-08-05 | Laurel Institutes | |
| 2026-08-05 | Labpharma | |
| 2026-08-05 | Genesis Engineering Group | |
| 2026-08-05 | Ruhrpumpen | |
| 2026-08-05 | The Metropolitan Entertainment & Convention Authority | |
| 2026-08-05 | Sutherland Packaging | |
| 2026-08-05 | Mayco International | |
| 2026-08-05 | Leviton | |
| 2026-08-05 | Brainhunter Companies LLC. and Brainhunter Systems Ltd. | |
| 2026-08-05 | The Miller Group | |
| 2026-08-05 | TSC Logistics | |
| 2026-08-05 | Reid Electric Service, Inc | |
| 2026-08-05 | Storer Transportation and Storer Coachways | |
| 2026-08-05 | Rocky Mount Recyclers | |
| 2026-08-05 | The Family Medicine Clinic |
CONFIRMED ATTACKS
Dark Project confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Dark Project incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2026 to April 2026. United States accounts for 2 of them (100%). The most affected sector is healthcare, at 2 confirmed victims. Where a figure was disclosed (1 case), these incidents account for 500 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Dark Project incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| April 2026 | Ohio Living | Healthcare | Ohio, United States | 500 | Unknown | Source |
| March 2026 | Mile Bluff Medical Center | Healthcare | Wisconsin, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Dark Project's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.