Brainhunter hit by Dark Project ransomware
Brainhunter Companies LLC and Brainhunter Systems Ltd., a US-based employment agency operating at brainhunter.com, have been hit by the Dark Project ransomware group. The incident was discovered on 5 August 2026.
Founded in 1995, Brainhunter provides staffing and recruiting services to engineers, IT, and healthcare clients. The group uses a double-extortion model, stealing data before encrypting local systems and threatening to leak it on their dark web portal. The leak site runs on nginx 1.24.0 behind the onion address darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion.
The new Dark Project group
Dark Project is a newly emerged ransomware leak operation that has been active since August 2026. The group operates a double extortion model: it exfiltrates sensitive data from victim systems before encrypting local files, then threatens to publish the stolen data on its dark web leak portal if the ransom is not paid.
The leak site runs on nginx 1.24.0 behind the onion address darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion. The group has confirmed 25 victims across 11 sectors, including Automotive, Charity & Nonprofits, Education, Engineering Services, Government & Defense, Healthcare, Hospitality, Human Resources & Staffing, Manufacturing, Professional Services, and Retail & E-Commerce. A single Tox hash (243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639) serves as the primary IoC for the group's infostealer payload.
19 known victims, 9 active extortion links
Dark Project has 19 known victims and 9 active extortion links on ransomware.live. The top five sectors are Manufacturing (8), Healthcare (5), Transportation (3), Professional Services (2), and one additional sector. The top five countries are United States (8), United Kingdom (2), Mexico (1), Germany (1), and Canada (1).
How the attack works
The group deploys an Infostealer to harvest credentials and sensitive data from victim systems before the encryption phase begins. The single Tox hash 243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639 serves as the primary IoC for the infostealer payload and is the main identifier for the group's file exchange.
The leak site is a single-page dark web portal running on nginx 1.24.0 behind the onion address darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion. It handles the file exchange and publishes the stolen data when the ransom deadline passes. Victims can deny the leak through the site's 'Victim has denied' status, which marks the entry as disputed on the portal.
Key points
- Dark Project is a new ransomware group first seen in April 2026, now active as of August 2026.
- Victims are Brainhunter Companies LLC and Brainhunter Systems Ltd., a US-based employment agency founded in 1995.
- The group has 19 known victims and 9 active extortion links on ransomware.live.
- Dark Project uses a double extortion model: it steals data before encrypting and threatens to leak it on its dark web portal.
- The group's leak site runs nginx 1.24.0 on a .onion domain.