Critical Infrastructure Threat: Leviton Sinks Under 1.4TB Dark Project Ransomware Exfiltration
Executive Summary
On August 5, 2026, Leviton—a global provider of electrical wiring, data center infrastructure, and energy management solutions—was targeted in a major cyberattack by the Dark Project ransomware syndicate. The attackers breached the central corporate network, compromised administrative domain controllers, and exfiltrated 1.4 Terabytes (TB) of sensitive data before deploying encryption.
The stolen dataset includes proprietary blueprints for electrical wiring, data center connectivity schematics, internal financial audits, executive communications, and employee records. This incident represents a significant supply-chain threat to the global commercial and government facilities that rely on Leviton hardware.
Deep-Dive Technical Analysis
The intrusion by Dark Project utilized sophisticated double-extortion tactics, characterized by a multi-phase execution.
1. Initial Intrusion and Active Directory Takeover
The threat actors gained access through a coordinated series of maneuvers:
* VPN Credential Harvesting: Administrative credentials were stolen via a targeted spear-phishing campaign against remote engineering staff.
* MFA Fatigue & Bypass: The group utilized prompt-bombing to bypass push-based Multi-Factor Authentication (MFA), allowing entry into the internal subnet.
* Privilege Escalation: Through Kerberoasting attacks against service principal names (SPNs), the actors extracted and cracked ticket hashes to obtain full Domain Admin rights across the Active Directory forest.
2. Bulk Exfiltration and Double-Extortion Execution
With domain-level control, the attackers focused on data theft and system paralysis:
* Targeted Staging: Custom PowerShell scripts were used to locate and stage files, specifically targeting CAD drawings (.dwg), financial databases, and source code.
* Encrypted Tunneling: 1.4 TB of data was exfiltrated to adversary-controlled cloud storage (Mega and S3) using Rclone over port 443, disguised as backup activity.
* Ransomware Deployment: The Dark Project binary was pushed via Group Policy Objects (GPOs). The group disabled Volume Shadow Copies and terminated database services like sqlservr.exe to ensure maximum encryption impact.
Incident Summary Table
Key Incident Detail
Specific Technical Information
Victim Organization
Leviton Manufacturing Co., Inc.
Disclosure Date
August 5, 2026
Attacking Group
Dark Project Ransomware Group
Volume Exfiltrated
1.4 Terabytes (1,400 Gigabytes)
Impacted Data Types
Data Center Schematics, Electrical Blueprints, HR Data, Financial Audits
Intrusion Vectors
VPN Credential Abuse, MFA Push Fatigue, Kerberoasting, GPO Ransomware Push
Industry Impact & Recommendations
The compromise of Leviton’s internal data poses downstream risks for smart buildings and critical infrastructure globally.
Supply-Chain Risk Analysis
* Blueprints Exposure: Leaked connectivity schematics and industrial diagrams may provide attack vectors for adversaries targeting facilities that utilize Leviton infrastructure.
* Vendor Trust: Corporate clients are advised to audit connected building management systems to ensure exfiltrated configuration data does not expose internal subnets.
Recommended Defense Controls
1. Phishing-Resistant MFA: Implement hardware security keys (FIDO2 / Passkeys) for all enterprise VPNs and remote access gateways to prevent push-fatigue attacks.
2. Active Directory Hardening: Audit service accounts, eliminate unnecessary SPNs, and enforce complex passwords (25+ characters) for managed service accounts (gMSAs).
3. Egress Bandwidth Anomaly Detection: Deploy network traffic analysis (NTA) tools to alert on bulk outbound transfers to unauthorized cloud storage.
4. Network Micro-Segmentation: Maintain air-gapped isolation between corporate IT environments and building management or operational technology (OT) systems.