dark project
ransomware group · aka None identified (no widely reported alternative names) · Unknown · active since 2026-09-07 (first victim post on leak site as tracked by this dashboard)
Victims · 7d
2▼1
Victims · 30d
11active targets
Victims · 90d
30
All-time (tracked)
30since 2026-08-05
Last post
09-15 17:37UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Dark Project is a newly emerged ransomware and data-extortion group that operates a leak site naming victims, consistent with a double-extortion model. All tracked leak-site activity is concentrated in a short window, with four victims posted between 2026-09-07 and 2026-09-09 and no postings since. Widely reported public research on the group's origin, infrastructure, ransomware strain, affiliate model, and ransom amounts was not identified, so these attributes are treated as unknown. The listed victims are known only from leak-site postings; independent public confirmation of the incidents was not identified. Defenders should treat Dark Project as an emerging, low-volume extortion operation and monitor for expanded activity.
Tactics & tooling
- Publishes victim names on a public leak site as extortion pressure (double-extortion model).
- Clustered posting cadence: all four tracked victims posted within a three-day window (2026-09-07 to 2026-09-09).
- Victim names suggest no single-sector or single-region focus; targeting appears broad (inferred from names only).
- Initial access, encryption methods, and exfiltration tooling: unknown (no vendor reporting identified).
- Affiliate or ransomware-as-a-service structure: unknown.
Targeted sectors
Inferred from victim names only: manufacturing, architecture/professional services, chemicals, building materials/construction
Notable public victims
Specchem LLC, MEI Architects, Alurwalls, Master Manufacturing Co., Inc.
Estimated earnings
No public figure.
Leak-site victims30 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Cumar Marble & Granite | · 3h ago | Cumar Marble & Granite, a company specializing in luxury kitchens, bathrooms, and custom projects, has been the target of a massive cyberattack. Hackers stole 489 gigabytes of data from the company’s servers, including personal information, technical drawings, and financial documents. This incident raises serious concerns regarding the theft of intellectual property and potential breaches of employee and customer privacy. |
| Specchem LLC | · 6d ago | A cyberattack on Specchem LLC resulted in a massive data breach. As a result of the incident, approximately 500 GB of data—containing roughly 700,000 files, including confidential personal and financial information—was stolen. |
| MEI Architects | · 7d ago | As a result of the attack, 340 GB of data (approximately 130,000 files) was stolen: including Social Security numbers, passports, green cards, invoices, HR documents, and a vast number of architectural drawings—including those from past and current projects, as well as those currently under construction. |
| Alurwalls | · 8d ago | Alurwalls was attacked, resulting in the theft of approximately 17 GB of confidential data. The stolen information includes banking and other financial documents, client building plans, and other personal data belonging to the company and its partners. Currently, more than 16,000 files are no longer protected by Alurwalls. |
| Master Manufacturing Co., Inc. | · 8d ago | Master Manufacturing Co specializing in custom metal stamping and production services has fallen victim to a significant cyberattack. Hackers reportedly exfiltrated 36 gigabytes of sensitive data from the company’s servers. The stolen information includes SQL databases containing personal data, as well as technical plans and schematics for custom metal parts. The breach raises serious concerns regarding intellectual property theft and potential privacy violations for employees and clients. |
| Dentist in New Britain, CT | · 21d ago | As a result of the attack, the following were compromised: the entire customer database, consisting of just over 8,000 files, as well as a small number of records containing Social Security numbers |
| Pump Engineering Company | · 21d ago | During the cyberattack, 120,000 files (115 GB) were stolen, including an extensive customer database, insurance documents, confidential financial documents, and a vast number of project drawings. |
| Furnished Quarters | · 22d ago | The company "Furnished Quarters" was the victim of a successful cyberattack, as a result of which the company’s confidential data was stolen. The volume of data stolen amounts to 155 GB. The data stolen included the company’s customer details, as well as documents containing banking and financial information. Currently, around 198,000 files are no longer under the control of "Furnished Quarters". |
| Design-Aire Engineering, INC | · 22d ago | Design-Aire Engineering, INC has suffered a cyberattack on its service systems, resulting in the theft of approximately 377GB of sensitive data. The breached information includes employees' personal data and detailed architectural plans of clients' buildings. |
| Jones, Little & Co., CPAs, LLP | · 22d ago | At least 100 gigabytes of company data—including financial records, internal files, and employee personal information—were stolen in a cyberattack. Hackers encrypted the firm's systems after exfiltrating the documents, leaving operations paralyzed. |
| The Liberty Group | · 22d ago | A company has suffered a major cyberattack resulting in the theft of approximately 27,000 internal files. The leaked documents include financial records, internal working materials, and personal data of employees. Attackers encrypted the company's systems following the breach, severely disrupting operations |
| Long-Lewis Automotive Group | · Aug 6, 2026 | Following a successful cyberattack on Long Lewis, more than 500 GB of confidential information was stolen. More than 15,000 records containing personal data of the organization’s customers and employees, important financial and banking documents, and other valuable company information were compromised. Currently, Long Lewis lost control of more than 650,000 files. |
| Thermo King | · Aug 5, 2026 | — |
| Mile Bluff Medical Center | · Aug 5, 2026 | — |
| Ohio Living Home Health & Hospice | · Aug 5, 2026 | — |
| Laurel Institutes | · Aug 5, 2026 | — |
| Labpharma | · Aug 5, 2026 | — |
| Genesis Engineering Group | · Aug 5, 2026 | — |
| Ruhrpumpen | · Aug 5, 2026 | — |
| The Metropolitan Entertainment & Convention Authority | · Aug 5, 2026 | — |
| Sutherland Packaging | · Aug 5, 2026 | — |
| Mayco International | · Aug 5, 2026 | — |
| Leviton | · Aug 5, 2026 | — |
| Brainhunter Companies LLC. and Brainhunter Systems Ltd. | · Aug 5, 2026 | — |
| The Miller Group | · Aug 5, 2026 | — |
| TSC Logistics | · Aug 5, 2026 | — |
| Reid Electric Service, Inc | · Aug 5, 2026 | — |
| Storer Transportation and Storer Coachways | · Aug 5, 2026 | — |
| Rocky Mount Recyclers | · Aug 5, 2026 | — |
| The Family Medicine Clinic | · Aug 5, 2026 | — |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .