A new ransomware operation is making an aggressive pitch to would-be criminals. According to reporting from eSecurity Planet, Dark Project offers affiliates 80% of extortion payments and claims 38 victims so far. The Dark Project ransomware affiliate model is a reminder that the economics of extortion keep shifting in favor of attackers, and that ordinary people often feel the consequences when an organization holding their data is hit.
This post covers what is known from the reporting, why the payout structure matters, and what both organizations and individuals can do. The source material is brief, so we stick to what it confirms: the 80% affiliate share and the claim of 38 victims.
How Dark Project's 80% affiliate payout works
Dark Project follows the ransomware-as-a-service (RaaS) model. In a RaaS arrangement, a core group builds and maintains the malware and the infrastructure around it. Affiliates, who are separate operators, carry out the actual intrusions and extortion attempts. When a victim pays, the money is split between the two sides.
Here, the reported split gives affiliates 80% of each extortion payment. The operators keep the remainder. The 38 victims figure is a claim made by the group, which means it should be treated as unverified until confirmed by the organizations involved or independent researchers.
The division of labor is the point of the model. The developers focus on tooling, leak sites, and negotiation infrastructure. Affiliates focus on getting in. Each side does less work than a fully independent crew would, which is why the model has spread so widely. For a deeper look at how an established group has operated under this approach, see our BlackCat/ALPHV ransomware profile.
Why generous RaaS splits lower the barrier to extortion
A high affiliate percentage is a recruitment tool. Newer groups have to compete for skilled intruders against established brands, and a larger cut is one way to attract them. An 80% share makes the offer financially appealing to anyone who can gain access to a network.
There is also a skills effect. Because the platform supplies the encryption tooling and the leak infrastructure, an affiliate does not need to write malware or run a negotiation operation. That lowers the technical bar and widens the pool of people who can attempt an attack.
The result is more attempts, spread across more targets, including organizations that hold sensitive records about people but have limited security budgets. The pattern is visible in incidents such as the ransomware attack on a nonprofit serving trafficking survivors, where the significance came less from technical sophistication than from who was affected.
What organizations should monitor and harden
Because affiliates are the ones breaking in, defenders should focus on the common routes into a network rather than on any single group's branding. Practical priorities include:
- Remote access: Review VPN, remote desktop, and other externally exposed services. Enforce multi-factor authentication and patch promptly.
- Credentials: Watch for unusual logins, reused passwords, and accounts with excess privileges.
- Data movement: Monitor for large or unexpected outbound transfers, since modern attacks typically involve stealing data before encrypting anything.
- Backups: Keep offline or immutable copies and test restoration regularly. Backups help recovery, but they do not undo data theft. Our double extortion explainer explains why.
- Leak site monitoring: Track whether your organization or vendors appear on extortion sites, so you can act early.
What this means for you
Most people will never be the direct target of a RaaS affiliate. The exposure comes second-hand: a employer, insurer, healthcare provider, or airline holds your data, and that organization is attacked. When extortion groups publish stolen files, the information can circulate widely, as in the leak of 8.7 million UK airport traveler records.
If a service you use is hit, consider these steps:
- Read the official notice carefully. Note what categories of data were involved and any protection offered, such as credit monitoring.
- Change your password for that service, and for any other account where you reused it. Use a password manager to create unique ones.
- Turn on multi-factor authentication wherever it is available.
- Watch for phishing. Stolen contact details are often used for convincing follow-up scams that reference the breach. Do not click links in unexpected messages; go to the organization's site directly.
- Monitor financial accounts and consider a credit freeze if identifiers such as Social Security numbers were exposed.
- Keep records of notices and any suspicious activity.
The takeaway
The Dark Project ransomware affiliate model illustrates a durable trend: when the revenue split favors the person doing the intrusion, more people are willing to try. The 38 victims claimed so far are unconfirmed, but the structure behind them is what matters. Organizations should harden access points and watch for data theft, and individuals should be ready to act quickly when a company they trust discloses a breach.
To understand why restoring from backups does not stop modern extortion, read our double extortion ransomware explainer. To see what stolen data can mean for real people, read our coverage of the Beacon Mutual ransomware breach.
