Embargo is a cybercriminal group operating under a Ransomware-as-a-Service (RaaS) model, first observed in June 2024. The group provides affiliates with the necessary tools and infrastructure to conduct attacks, retaining control over core operations like payment negotiations. Embargo is suspected with moderate confidence to be of Russian origin and its primary motivation is financial gain, though some incidents have incorporated politically charged messages. The group is distinguished by its use of the Rust programming language for its custom malware and its aggressive double extortion tactics, which involve encrypting victim data while also exfiltrating sensitive information to pressure victims into paying, often threatening to leak data on dedicated sites. Embargo is assessed by some as a possible rebranded or successor operation to BlackCat (ALPHV), sharing technical and behavioral similarities.

Aliases del actor

lo que sugiere una red de actividades coordenadasComment PandaPLA Unit 61398TG-8223APT1BrownFoxGroup 3GIF89aShadyRATShanghai GroupByzantine CandorG0006TG-0110APT3BuckeyeUPS TeamGroup 6Boyusec – the Guangzhou Boyu Information Technology CompanyLtd1“PdPD” (50 64 50 44)un código de marcación para binarios encriptadosWet PandaBRONZE OLIVEBaristaChina Chopperentre otrosCVE-2015-2545TaiwanThailandTamper Pandarefuerzan la necesidad de monitoreo continuo

Actores similares

Conquerors Electronic Armyapt · 0Operation DRBControlapt · 0Eloquent Pandaapt · 0eloquent-pandaactor · 1PhantomControlapt · 0Container Orchestration Jobactor · 1redcontroleactor · 1LUNAR SPIDERapt · 0apt-desertfalconactor · 1Group Space Bearsransomware · 0

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker