[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu4ydXgHLuYQUPldRlHHWuRe3HUCcDdBDXf6JoDgnWGY":3,"$faUZFXfFDNQ4omVU0ZJRTgseZC_HrhtvwvOO5kGQ1DHc":53},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":50,"created_at":51,"updated_at":52,"published_at":29},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","The new group has 19 known victims and 9 active extortion links on ransomware.live.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[10,11,12,13,14],"Dark Project","Brainhunter","ransomware","double extortion","ransomware.live","# Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.\n\n*The new group has 19 known victims and 9 active extortion links on ransomware.live.*\n\n**Tags:** `Dark Project` `Brainhunter` `ransomware` `double extortion` `ransomware.live`\n\n> Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.\n\n---\n\n## Brainhunter hit by Dark Project ransomware\n\nBrainhunter Companies LLC and Brainhunter Systems Ltd., a US-based employment agency operating at brainhunter.com, have been hit by the Dark Project ransomware group. The incident was discovered on 5 August 2026.\n\nFounded in 1995, Brainhunter provides staffing and recruiting services to engineers, IT, and healthcare clients. The group uses a double-extortion model, stealing data before encrypting local systems and threatening to leak it on their dark web portal. The leak site runs on nginx 1.24.0 behind the onion address darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion.\n\n## The new Dark Project group\n\nDark Project is a newly emerged ransomware leak operation that has been active since August 2026. The group operates a double extortion model: it exfiltrates sensitive data from victim systems before encrypting local files, then threatens to publish the stolen data on its dark web leak portal if the ransom is not paid.\n\nThe leak site runs on nginx 1.24.0 behind the onion address `darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion`. The group has confirmed 25 victims across 11 sectors, including Automotive, Charity & Nonprofits, Education, Engineering Services, Government & Defense, Healthcare, Hospitality, Human Resources & Staffing, Manufacturing, Professional Services, and Retail & E-Commerce. A single Tox hash (`243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639`) serves as the primary IoC for the group's infostealer payload.\n\n## 19 known victims, 9 active extortion links\n\nDark Project has 19 known victims and 9 active extortion links on ransomware.live. The top five sectors are Manufacturing (8), Healthcare (5), Transportation (3), Professional Services (2), and one additional sector. The top five countries are United States (8), United Kingdom (2), Mexico (1), Germany (1), and Canada (1).\n\n## How the attack works\n\nThe group deploys an Infostealer to harvest credentials and sensitive data from victim systems before the encryption phase begins. The single Tox hash `243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639` serves as the primary IoC for the infostealer payload and is the main identifier for the group's file exchange.\n\nThe leak site is a single-page dark web portal running on nginx 1.24.0 behind the onion address `darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion`. It handles the file exchange and publishes the stolen data when the ransom deadline passes. Victims can deny the leak through the site's 'Victim has denied' status, which marks the entry as disputed on the portal.\n\n## Key points\n\n- Dark Project is a new ransomware group first seen in April 2026, now active as of August 2026.\n- Victims are Brainhunter Companies LLC and Brainhunter Systems Ltd., a US-based employment agency founded in 1995.\n- The group has 19 known victims and 9 active extortion links on ransomware.live.\n- Dark Project uses a double extortion model: it steals data before encrypting and threatens to leak it on its dark web portal.\n- The group's leak site runs nginx 1.24.0 on a .onion domain.\n\n## Further reading & sources\n\n- [Dark Project Ransomware | WatchGuard Technologies](https:\u002F\u002Fwatchguard.com\u002Fwgrd-security-hub\u002Fransomware-tracker\u002Fdark-project)\n- [Ransomware Group Dark Project Hits: Brainhunter Companies LLC. and Brainhunter Systems Ltd.](https:\u002F\u002Fhookphish.com\u002Fblog\u002Fransomware-group-dark-project-hits-brainhunter-companies-llc-and-brainhunter-systems-ltd)\n- [Ransomware.live: Dark Project](https:\u002F\u002Fransomware.live\u002Fgroup\u002FDark%20Project)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac",{"iocs":18,"actors":25,"malware":30,"targets":33,"industries":39,"technologies":47},[19,22],{"type":20,"value":21},"other","243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639",{"type":23,"value":24},"domain","darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion",[26],{"url":27,"name":10,"slug":28,"type":12,"origin":29,"motivation":29},"\u002Fthreat-groups\u002Fdark-project","dark-project",null,[31],{"name":32},"Infostealer",[34],{"name":35,"sector":36,"status":37,"geography":38},"Brainhunter Companies LLC. and Brainhunter Systems Ltd.","Professional Services","confirmed","US",[40,43],{"url":41,"name":36,"slug":42},"\u002Findustries\u002Fprofessional-services","professional-services",{"url":44,"name":45,"slug":46},"\u002Findustries\u002Ftechnology","Technology","technology",[48],{"vendor":49,"product":49},"nginx","ransomware_incident","2026-09-21T07:02:16.98855+00:00","2026-10-16T12:28:20.520518+00:00",{"articles":54},[55,65,77,88],{"slug":56,"title":57,"summary":58,"tags":59,"hero_image_url":63,"story_type":50,"created_at":64},"satanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims","SatanLock ransomware group shuts down after six months, claims 67 victims","SatanLock, a double-extortion ransomware group, has ceased operations after roughly six months, claiming 67 compromised organizations and leaking stolen data.",[12,60,61,62,13],"SatanLock","sanlockv2","data leak","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsatanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims.png?v=99e2fb1938","2026-08-26T12:10:42.22722+00:00",{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":75,"story_type":50,"created_at":76},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[12,70,71,72,73,74],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":86,"story_type":50,"created_at":87},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[82,83,84,62,85,12],"Silent Ransom Group","Troutman Pepper Locke","law firm","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":89,"title":90,"summary":91,"tags":92,"hero_image_url":97,"story_type":50,"created_at":98},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[12,93,94,95,96],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00"]