Ransomware Group
Embargo
Status: active • First seen 2024-05 • 40+ known victims
Embargo is particularly sneaky because they bring special tools that turn off security software before attacking. This makes them very hard to catch with normal antivirus programs.
Overview
Embargo is a Rust-based ransomware operation that employs sophisticated EDR killer tools to disable endpoint protection before deploying their payload.
Target Industries
Healthcare, Manufacturing, Technology, Professional Services
How They Attack
- • Rust-based payload
- • EDR killer tools
- • Double extortion
- • Defense evasion
Notable Victims
Healthcare organizations (2024), Technology firms
Is your business exposed?
How to Protect Against Embargo
- 1.
Enable tamper protection on all EDR agents
- 2.
Monitor for EDR evasion techniques
- 3.
Implement defense-in-depth security
MITRE ATT&CK Techniques
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required