Embargo | Netskope Threat Labs

Description

Embargo is a Rust based ransomware variant active since at least May 2024 that runs double extortion operations, exfiltrating data before encryption and threatening publication if victims do not pay. Its deliveries used the MDeployer loader together with the MS4Killer component, which terminates processes on victim hosts to clear the way for encryption.

Stats

First seen: May 2024
Last seen: October 2026

MITRE ATT&CK techniques

22 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1068Exploitation for Privilege Escalation

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1679Selective Exclusion

TA0007 Discovery

T1007System Service Discovery
T1057Process Discovery
T1083File and Directory Discovery
T1135Network Share Discovery

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1657Financial Theft

TA0112 Defense Impairment

T1112Modify Registry
T1688Safe Mode Boot

Associated groups

G1053Storm-0501

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.Embargo.1	AV
Gen:Variant.Ransom.Embargo.2	AV
Trojan.Ransom.Embargo.2	AV
Win32.Ransomware.Embargo	ATP Sandbox Adv. Heuristics
Win64.Trojan.Embargo	ATP Sandbox Adv. Heuristics

Related families

Qilin InvisiMole REvil PlugX DarkGate

References

attack.mitre.org