A new ransomware group has made its presence known in the threat landscape by compromising ten (10) victims in a short period of time. The group calls themselves Dark Power and are believed to be operational since late January 2023, according to compiled data from their ransomware encryptor. Dark Power actors are following trends of several ransomware gangs by practicing double extortion, exfiltrating and encrypting the victim’s data before later posting the exfiltrated data to their leak site if ransom demands are not met. Ransom demands uncovered to this point average $10,000, which is significantly lower than major players in the ransomware scene. Thus far, victims of Dark Power appear to operate in countries across the globe including Algeria, Egypt, France, Turkey, United States, and several others. So far, these actors have compromised at least ten (10) organizations encompassing several industries such as education, IT services, food production, healthcare, and manufacturing. An interesting tactic, technique, and procedure (TTP) of the group is that rather than utilizing text files to display ransom notes, Dark Power uses a PDF document in its place to show the ransom demand, qTox for negotiations, and onion address to the victim leak page. Overall, based on the variety of locations and industries Dark Power is targeting, they appear to compromise entities by opportunity rather than focusing on a direct country or industry, showing that the group is ready to make a name for themselves. Observed indicators of compromise (IOCs) can be viewed in the report linked below. CTIX continues to track threat actor activity worldwide and will provide additional updates accordingly.