Embargo

Malware

6 incidents First seen 2026-05-11 Last seen 2026-09-03

Overview

                            
                             Highlight CTI
                        

Embargo is a ransomware variant written in Rust that has been active since at least May 2024. Embargo ransomware operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Embargo ransomware has been known to be delivered through a loader known as MDeployer which also leverages a malware component known as MS4Killer that facilitates termination of processes operating on the victim hosts. Embargo is also reportedly a Ransomware as a Service (RaaS).

Investigate in CTI Graph Login required Open in Dashboard

Threat ecosystem

Actors Malware Campaigns CVEs

Tap a node for a quick look · double-tap to open its profile

At a glance

peak priority 160 27 techniques 1 groups use it ESXiLinuxWindows in ATT&CK since 2025-10-19 updated 2025-10-20 · v1.0

Activity by month (incidents)

2026-052026-09

Sectors targeted

finance · 2manufacturing · 2cryptocurrency · 1government · 1hospitality · 1retail · 1technology · 1

Countries targeted

JP · 4RU · 4AR · 3AU · 3BR · 3CH · 3DE · 3GB · 3ID · 3IN · 3IT · 3KR · 3

Origin

AU · 1CA · 1RU · 1US · 1

Kinds of incident

Data Breach · 2Malware & Botnets · 2Ransomware & Extortion · 2AI-Enabled Attack · 1Exploited Vulnerability · 1Phishing & Social Engineering · 1

Techniques seen in incidents

Ransomware · 5Extortion · 3Lateral Movement · 3Privilege Escalation · 3Data Leak · 2Phishing · 2Reconnaissance · 2T1588.002 - Tool · 2Exfiltration · 1Impersonation · 1Social Engineering · 1T1059.001 - PowerShell · 1T1059.007 - JavaScript · 1T1588.001 - Malware · 1

Related CVEs

CVE-2024-55591 · 2CVE-2025-32433 · 2CVE-2025-33073 · 2CVE-2025-61882 · 1CVE-2026-31431 · 1CVE-2026-43284 · 1CVE-2026-43500 · 1

ATT&CK techniques by tactic (27)

execution T1053.005 Scheduled Task T1059.003 Windows Command Shell T1106 Native API T1569.002 Service Execution

persistence T1053.005 Scheduled Task T1112 Modify Registry T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

privilege escalation T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

discovery T1007 System Service Discovery T1057 Process Discovery T1083 File and Directory Discovery T1135 Network Share Discovery

impact T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1657 Financial Theft

stealth T1027.013 Encrypted/Encoded File T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1480.002 Mutual Exclusion T1679 Selective Exclusion

defense impairment T1112 Modify Registry T1688 Safe Mode Boot

Groups that use it

Storm-0501