Ransomware Group

Embargo

Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.

Known victims41

Threat level

MEDIUM

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

DefenseEvasion

s4killer (Minifilter Driver)

LOLBAS

BCDEdit
ServiceControl (sc.exe)

Known infrastructure

The following Tor hidden services have been associated with this group:

olpvpdu4dotl54dereuembantzyjqzftjqj2ovvlfgcvw23qknuxzjad.onion
rlseptkjo5yt2c3m4ov7hmhxmb2uia3cic3ohq2u5tmb2uv4enovhfid.onion
dr4zejrunmmijebc4jhz6xwplapeltdqdchvbvikiwitvrtjedcezmad.onion
3kt5ouf4qxdkuzsct6zp3jxsqmtaqjsun3uvfdwbeuo2yizjp73ripyd.onion
y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onion

These sites are malicious. Open them only from an isolated environment.

Check if you’re affected

Look up your domain to see whether it appears on Embargo’s victim list.

Try it nowFree⌘K

Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBit ALPHV Blackcat CL0P Play BianLian Akira Medusa Rhysida