Embargo is a cybercriminal group operating under a Ransomware-as-a-Service (RaaS) model, first observed in June 2024. The group provides affiliates with the necessary tools and infrastructure to conduct attacks, retaining control over core operations like payment negotiations. Embargo is suspected with moderate confidence to be of Russian origin and its primary motivation is financial gain, though some incidents have incorporated politically charged messages. The group is distinguished by its use of the Rust programming language for its custom malware and its aggressive double extortion tactics, which involve encrypting victim data while also exfiltrating sensitive information to pressure victims into paying, often threatening to leak data on dedicated sites. Embargo is assessed by some as a possible rebranded or successor operation to BlackCat (ALPHV), sharing technical and behavioral similarities.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker