Overview
Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America26
Singapore2
India1
Hungary1
Lesotho1
Taiwan, Province of China1
Türkiye1
United Kingdom1
Brazil1
Oman1
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
- s4killer (Minifilter Driver)
- BCDEdit
- ServiceControl (sc.exe)
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| — | Files | 7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad[.]onion | No |
| EMBARGO | DLS | embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid[.]onion | Yes |
| Index of / | Files | v6pggtfljylf5cekfssrdhcyaxsk6m5xoudrqnvskw73iueyvaexsnad[.]onion | Yes |
| Index of / | Files | byodkksxj3pdnn4dvkouo6oshztjgc45accwvbd7e53heil7s2tfrtyd[.]onion | Yes |
| Index of / | Files | gvhj726josrtcuig76yfme5x72d7xqbevgsqm26ua3qcmskxddnx3oid[.]onion | Yes |
| Index of / | Files | rdur3c3dxhjjpfxebaiba6fuj6lqrcdtqfzengynkg5ptyelcclgvdid[.]onion | Yes |
| Index of / | Files | p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad[.]onion | Yes |
| Index of / | Files | katqzwogbio5ro3glh4k5cmbz2zxeac5az2pebzg4e6n7gw66di7ihad[.]onion | Yes |
| Index of / | Files | fvbobs6fcm5lske2xhfyx5sazn3i5cbxrbdyozoio23ouhnmortg5fyd[.]onion | Yes |
| — | Files | 76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd[.]onion | No |
| — | Files | qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd[.]onion | No |
| — | Files | 22g3uiuyqqa4txxuyvzmlyvlou4crrgfvgnvodrv3wrxcedtvjgx6aid[.]onion | No |
| — | Files | nbgvwttzh35irjtnxgeaydqob6ixorgabbufb4ociefv4zklyppu5lad[.]onion | No |
| Index of / | Files | zs3swtx3pkpi6qy3umpei5ophcvblu6zo3uwi3v2zda7h4lv2iup2iqd[.]onion | Yes |
| Index of / | Files | clqt3b3ldzxyemjrkvgsm5so2tyus7f7i2ia5qvikt4623srq5w3d7ad[.]onion | Yes |
| — | Files | 7t635vqx6zm733ryjj5jm6hnavlw2it3umi3zmbq6gd6nhaeaylsbsyd[.]onion | No |
| — | Files | g7hva5likuonhljhh3sp2nvg7pezpu45vpxjccgihevwpb4fi2napqad[.]onion | No |
| Index of / | Files | bjy6kwjxxepe6v3vjlxhir4qzdpl7jvwvxua6wvemyfm44di2cxdd4qd[.]onion | Yes |
| — | Files | dr4zejrunmmijebc4jhz6xwplapeltdqdchvbvikiwitvrtjedcezmad[.]onion | No |
| Index of / | Files | qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd[.]onion | Yes |
| — | Files | wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd[.]onion | No |
| — | Files | y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd[.]onion | No |
| — | Files | 3kt5ouf4qxdkuzsct6zp3jxsqmtaqjsun3uvfdwbeuo2yizjp73ripyd[.]onion | No |
| — | Files | vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd[.]onion | No |
| — | Files | fanr4dyego253yx5pmbc7krct6qzq3hqfrchvj5fafiwalvjijfgsmid[.]onion | No |
| — | Files | 4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad[.]onion | No |
| — | Files | 5dw7bszmidrhpoltqbqmpixpz6mvgez3mr6xc7ktval2glrmbxkwopad[.]onion | No |
| — | Files | ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd[.]onion | No |
| — | Files | rngjexyyyl5mek5kg2lkxilqfef5nr6bpa4u24i5ei5hb3ydsh5drpid[.]onion | No |
| — | Files | olpvpdu4dotl54dereuembantzyjqzftjqj2ovvlfgcvw23qknuxzjad[.]onion | No |
| — | Files | kk3puzzmu6jfzll6sllchr5olxf4bg4tl7uyq7wtiqqpntkreya3qxqd[.]onion | No |
| — | Files | yunznlzrpp7oa45og6unujpp4t3f4m2sqh2b4vuhct3kmbxxj6lwqbqd[.]onion | No |
| — | Files | n56t64ldkhzygjk5cqa2f3r4xxjqzaftusjy56z25qcnun6ab4cijeqd[.]onion | No |
| — | Files | orxo6qmizqa43suoox3xteu6645y4zf2bpvnsutb2yq3n2lpprw2x7yd[.]onion | No |
| — | Files | tamvd5fdyvpekhaf2sdg5sum73ra2abc4h2iqihijpvw4hythnlmuhid[.]onion | No |
| — | Files | 6cs2fy7brjjx3fza7ny2vyhbkaxtn6rdx4p4js2lbgyhke7z4aslxtid[.]onion | No |
| — | Files | wsw3zgmaw32cjt4j4iwwpg7td7qgrh2fp2p34pvhupyqke6ilepsnqad[.]onion | No |
| — | Files | jolfnfw6lmcjsppgjfimhimqt2t7viybk67yc5zkxip6fxrcgo7mv4id[.]onion | No |
| — | Files | z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd[.]onion | No |
| — | Files | 73klffkonzmo6csfca75k67rniemcvlc2ydnfnkk54cqnkmdk2yqxqad[.]onion | No |
| — | Files | rlseptkjo5yt2c3m4ov7hmhxmb2uia3cic3ohq2u5tmb2uv4enovhfid[.]onion | No |
| — | Files | 7jkcp27353enwfwdemqgsevyjbtz5cxv66n5ctfgd37h2mdxbhhiluyd[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11