Date: 11/05/2026
Severity: High
Summary
DARK PROJECT is a financially motivated ransomware group that employs double-extortion tactics, combining data theft with file encryption to pressure victims into paying ransoms. According to the report, the group recently posted three new victims across the United States and the Philippines, targeting the Energy, Transportation & Logistics, and Automotive industries. Its reported attack methods include exploiting exposed services, abusing remote access, and stealing sensitive organizational data. The targeting of these sectors highlights potential risks to critical infrastructure, business operations, and sensitive customer information.
Indicators of Compromise (IOC) List
Domains/URLs | darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion 2qdmbim5lvsf5fvlo4r56xv6l6pbx2rkp5janecdnceucetgyizckyad.onion darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion 2qdmbim5lvsf5fvlo4r56xv6l6pbx2rkp5janecdnceucetgyizckyad.onion jsqsgn6vehow5jnjqohteaqnhko6pmdvjzbim57bdvdtgobrmoibjzad.onion frwvvaqob3ofmegrbc4q2ovtwyf5u7ozyyv35unib3saq3ppx2pkwuad.onion 667k2ck7qlzoqt52i6dq7evcfzko2ezfrhgv6zziccjet2cc653kvbid.onion e6q3vpkqpqjnerdtseb5wkgmuluqfsluu2sgwjghtrlf2u2pzybrlzid.onion kic4bflgzxoo2oq5wn52frqpzba2b75iodhqjgtdulchdeph73kq6zqd.onion 7y6rr2oawf63yf2zjdidijun7p6gtjqye7b44vqyvilva3or324k3kad.onion x4emye5homuwkrvrfaoql53hc5spbazkvcw3m4pv6jaj5tjqmjizleqd.onion 2zl5qc3mqap7vziqfis65oyjcgdiedigoequxbqsn6uwian7ieozvoqd.onion pokttabd2hod47ladeeoin22wmq4remyo3wshwvxfuhgqygcbezq2qqd.onion x2jz63qemhcbhyskzt3pie757oicdkctk2rh5dpykmxsw2yoayeqs5yd.onion t2ru74fbgut26xnagtrl4ajeh5vqytrl6cpr6cubmr6sqdxk5guh5mqd.onion wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd.onion 3i5px2hibsyityv6jixnqba35yz25jekbwwumjdxjqzt3euqsygjx5id.onion tjaaioz32salcoj63ttxra6nfqggwbcezkzpwnhyoiwq5tuimzmsb3qd.onion |
Hash | 0ff081cd5bd3b2dd2b1742bc5123d915dec362cc
|
Note | README-RECOVERY-[ID].txt |
TOX ID | 243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639 |
Processnames | \psexec.exe \psexesvc.exe \wmic.exe \rclone.exe \megacmd.exe \vssadmin.exe \wmic.exe \bcdedit.exe \screenconnect.clientservice.exe \screenconnect.windowsclient.exe C:\Program Files\ScreenConnect C:\Program Files\ConnectWise C:\Program Files (x86)\ScreenConnect |
Commandline | delete shadows shadowcopy delete recoveryenabled no |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion" or siteurl like "https://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion" or url like "https://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion" or domainname like "https://2qdmbim5lvsf5fvlo4r56xv6l6pbx2rkp5janecdnceucetgyizckyad.onion" or siteurl like "https://2qdmbim5lvsf5fvlo4r56xv6l6pbx2rkp5janecdnceucetgyizckyad.onion" or url like "https://2qdmbim5lvsf5fvlo4r56xv6l6pbx2rkp5janecdnceucetgyizckyad.onion" or domainname like "jsqsgn6vehow5jnjqohteaqnhko6pmdvjzbim57bdvdtgobrmoibjzad.onion" or siteurl like "jsqsgn6vehow5jnjqohteaqnhko6pmdvjzbim57bdvdtgobrmoibjzad.onion" or url like "jsqsgn6vehow5jnjqohteaqnhko6pmdvjzbim57bdvdtgobrmoibjzad.onion" or domainname like "frwvvaqob3ofmegrbc4q2ovtwyf5u7ozyyv35unib3saq3ppx2pkwuad.onion" or siteurl like "frwvvaqob3ofmegrbc4q2ovtwyf5u7ozyyv35unib3saq3ppx2pkwuad.onion" or url like "frwvvaqob3ofmegrbc4q2ovtwyf5u7ozyyv35unib3saq3ppx2pkwuad.onion" or domainname like "667k2ck7qlzoqt52i6dq7evcfzko2ezfrhgv6zziccjet2cc653kvbid.onion" or siteurl like "667k2ck7qlzoqt52i6dq7evcfzko2ezfrhgv6zziccjet2cc653kvbid.onion" or url like "667k2ck7qlzoqt52i6dq7evcfzko2ezfrhgv6zziccjet2cc653kvbid.onion" or domainname like "e6q3vpkqpqjnerdtseb5wkgmuluqfsluu2sgwjghtrlf2u2pzybrlzid.onion" or siteurl like "e6q3vpkqpqjnerdtseb5wkgmuluqfsluu2sgwjghtrlf2u2pzybrlzid.onion" or url like "e6q3vpkqpqjnerdtseb5wkgmuluqfsluu2sgwjghtrlf2u2pzybrlzid.onion" or domainname like "kic4bflgzxoo2oq5wn52frqpzba2b75iodhqjgtdulchdeph73kq6zqd.onion" or siteurl like "kic4bflgzxoo2oq5wn52frqpzba2b75iodhqjgtdulchdeph73kq6zqd.onion" or url like "kic4bflgzxoo2oq5wn52frqpzba2b75iodhqjgtdulchdeph73kq6zqd.onion" or domainname like "7y6rr2oawf63yf2zjdidijun7p6gtjqye7b44vqyvilva3or324k3kad.onion" or siteurl like "7y6rr2oawf63yf2zjdidijun7p6gtjqye7b44vqyvilva3or324k3kad.onion" or url like "7y6rr2oawf63yf2zjdidijun7p6gtjqye7b44vqyvilva3or324k3kad.onion" or domainname like "x4emye5homuwkrvrfaoql53hc5spbazkvcw3m4pv6jaj5tjqmjizleqd.onion" or siteurl like "x4emye5homuwkrvrfaoql53hc5spbazkvcw3m4pv6jaj5tjqmjizleqd.onion" or url like "x4emye5homuwkrvrfaoql53hc5spbazkvcw3m4pv6jaj5tjqmjizleqd.onion" or domainname like "2zl5qc3mqap7vziqfis65oyjcgdiedigoequxbqsn6uwian7ieozvoqd.onion" or siteurl like "2zl5qc3mqap7vziqfis65oyjcgdiedigoequxbqsn6uwian7ieozvoqd.onion" or url like "2zl5qc3mqap7vziqfis65oyjcgdiedigoequxbqsn6uwian7ieozvoqd.onion" or domainname like "pokttabd2hod47ladeeoin22wmq4remyo3wshwvxfuhgqygcbezq2qqd.onion" or siteurl like "pokttabd2hod47ladeeoin22wmq4remyo3wshwvxfuhgqygcbezq2qqd.onion" or url like "pokttabd2hod47ladeeoin22wmq4remyo3wshwvxfuhgqygcbezq2qqd.onion" or domainname like "x2jz63qemhcbhyskzt3pie757oicdkctk2rh5dpykmxsw2yoayeqs5yd.onion" or siteurl like "x2jz63qemhcbhyskzt3pie757oicdkctk2rh5dpykmxsw2yoayeqs5yd.onion" or url like "x2jz63qemhcbhyskzt3pie757oicdkctk2rh5dpykmxsw2yoayeqs5yd.onion" or domainname like "t2ru74fbgut26xnagtrl4ajeh5vqytrl6cpr6cubmr6sqdxk5guh5mqd.onion" or siteurl like "t2ru74fbgut26xnagtrl4ajeh5vqytrl6cpr6cubmr6sqdxk5guh5mqd.onion" or url like "t2ru74fbgut26xnagtrl4ajeh5vqytrl6cpr6cubmr6sqdxk5guh5mqd.onion" or domainname like "wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd.onion" or siteurl like "wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd.onion" or url like "wjcml4mxpcvsmjxm33zhjb46nzutxk6g3f5w23fopgpwj6pqjcidiyqd.onion" or domainname like "3i5px2hibsyityv6jixnqba35yz25jekbwwumjdxjqzt3euqsygjx5id.onion" or siteurl like "3i5px2hibsyityv6jixnqba35yz25jekbwwumjdxjqzt3euqsygjx5id.onion" or url like "3i5px2hibsyityv6jixnqba35yz25jekbwwumjdxjqzt3euqsygjx5id.onion" or domainname like "tjaaioz32salcoj63ttxra6nfqggwbcezkzpwnhyoiwq5tuimzmsb3qd.onion" or siteurl like "tjaaioz32salcoj63ttxra6nfqggwbcezkzpwnhyoiwq5tuimzmsb3qd.onion" or url like "tjaaioz32salcoj63ttxra6nfqggwbcezkzpwnhyoiwq5tuimzmsb3qd.onion" |
Detection Query 2 : | sha1hash IN ("0ff081cd5bd3b2dd2b1742bc5123d915dec362cc")
|
Detection Query 3 : | datasourcename = "Windows Security" and eventtype = "4688" and (processname IN ("psexec.exe","psexesvc.exe","wmic.exe","rclone.exe","megacmd.exe","filezilla.exe") OR (processname IN ("vssadmin.exe","wmic.exe","bcdedit.exe") AND (commandline like "delete shadows" or commandline like "shadowcopy delete" or commandline like "recoveryenabled no"))) |
Detection Query 4 : | technologygroup = "EDR" and (processname IN ("psexec.exe","psexesvc.exe","wmic.exe","rclone.exe","megacmd.exe","filezilla.exe") OR (processname IN ("vssadmin.exe","wmic.exe","bcdedit.exe") AND (commandline like "delete shadows" or commandline like "shadowcopy delete" or commandline like "recoveryenabled no"))) |
Detection Query 5 : | datasourcename = "Windows Security" and eventtype = "4688" and (processname IN ("screenconnect.clientservice.exe","anydesk.exe","teamviewer.exe","screenconnect.windowsclient.exe") AND processname not IN ("C:\Program Files\ScreenConnect","C:\Program Files\ConnectWise","C:\Program Files (x86)\ScreenConnect")) |
Detection Query 6 : | technologygroup = "EDR" and (processname IN ("screenconnect.clientservice.exe","anydesk.exe","teamviewer.exe","screenconnect.windowsclient.exe") AND processname not IN ("C:\Program Files\ScreenConnect","C:\Program Files\ConnectWise","C:\Program Files (x86)\ScreenConnect")) |
Detection Query 7 : | datasourcename = "checkpoint" and action like "accept" and protocol like "IKEv1" and srcipaddress not IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") |
Detection Query 8 : | technologygroup = "VPN" and action like "accept" and protocol like "IKEv1" and srcipaddress not IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") |
Reference:
DARK PROJECT Ransomware Campaign
Double-Extortion Attacks on Critical Industries
DARK PROJECT Targets Global Organizations