Ransomware.live: Embargo

| Active | RaaS

Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.

Victims

First Victim

2024-04-17

(est. attack date)

Discovery Date

2024-04-21

Last Seen

2026-09-09

Inactive Since

days

Avg Delay

7.8

days

Infostealer

50.0%

victims with domain

Countries

hit

Uptime

83.0% avg (30d)

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months (based on attack estimated date if available)

Known Locations (42)

Title	Available	Last Visit	Server Info	FQDN
EMBARGO	Yes	2026-10-10T16:45:41	nginx	`embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion`
Index of /	Yes	2026-10-10T22:11:16	nginx 1.29.6	`v6pggtfljylf5cekfssrdhcyaxsk6m5xoudrqnvskw73iueyvaexsnad.onion`
Index of /	Yes	2026-10-10T22:12:36	nginx 1.29.6	`katqzwogbio5ro3glh4k5cmbz2zxeac5az2pebzg4e6n7gw66di7ihad.onion`
Index of /	Yes	2026-10-12T02:36:00	nginx 1.29.6	`zs3swtx3pkpi6qy3umpei5ophcvblu6zo3uwi3v2zda7h4lv2iup2iqd.onion`
Index of /	Yes	2026-10-11T02:10:03	nginx 1.29.6	`fvbobs6fcm5lske2xhfyx5sazn3i5cbxrbdyozoio23ouhnmortg5fyd.onion`
Index of /	Yes	2026-10-10T22:13:18	nginx 1.29.6	`gvhj726josrtcuig76yfme5x72d7xqbevgsqm26ua3qcmskxddnx3oid.onion`
Index of /	Yes	2026-10-14T11:08:59	nginx 1.29.6	`clqt3b3ldzxyemjrkvgsm5so2tyus7f7i2ia5qvikt4623srq5w3d7ad.onion`
Index of /	Yes	2026-10-13T18:38:15	nginx 1.29.6	`rdur3c3dxhjjpfxebaiba6fuj6lqrcdtqfzengynkg5ptyelcclgvdid.onion`
Index of /	Yes	2026-10-10T21:10:12	nginx 1.29.6	`byodkksxj3pdnn4dvkouo6oshztjgc45accwvbd7e53heil7s2tfrtyd.onion`
	No	2026-10-10T21:10:22		`dr4zejrunmmijebc4jhz6xwplapeltdqdchvbvikiwitvrtjedcezmad.onion`
Index of /	Yes	2026-10-10T21:10:58	nginx 1.29.6	`bjy6kwjxxepe6v3vjlxhir4qzdpl7jvwvxua6wvemyfm44di2cxdd4qd.onion`
	No	2026-10-14T00:42:00		`n56t64ldkhzygjk5cqa2f3r4xxjqzaftusjy56z25qcnun6ab4cijeqd.onion`
Index of /	Yes	2026-10-13T22:38:24	nginx 1.29.6	`yunznlzrpp7oa45og6unujpp4t3f4m2sqh2b4vuhct3kmbxxj6lwqbqd.onion`
	No	2026-10-10T17:05:05		`nbgvwttzh35irjtnxgeaydqob6ixorgabbufb4ociefv4zklyppu5lad.onion`
	No	2026-10-14T12:36:11		`22g3uiuyqqa4txxuyvzmlyvlou4crrgfvgnvodrv3wrxcedtvjgx6aid.onion`
	No	2026-10-14T12:38:22		`kk3puzzmu6jfzll6sllchr5olxf4bg4tl7uyq7wtiqqpntkreya3qxqd.onion`
	No	2026-10-12T18:38:34		`orxo6qmizqa43suoox3xteu6645y4zf2bpvnsutb2yq3n2lpprw2x7yd.onion`
	No	2026-10-14T12:37:54		`7jkcp27353enwfwdemqgsevyjbtz5cxv66n5ctfgd37h2mdxbhhiluyd.onion`
	No	2026-10-13T22:41:45		`rlseptkjo5yt2c3m4ov7hmhxmb2uia3cic3ohq2u5tmb2uv4enovhfid.onion`
	No	2026-10-14T12:37:51		`g7hva5likuonhljhh3sp2nvg7pezpu45vpxjccgihevwpb4fi2napqad.onion`
	No	2026-10-11T00:12:48		`fanr4dyego253yx5pmbc7krct6qzq3hqfrchvj5fafiwalvjijfgsmid.onion`
	No	2026-10-14T12:38:00		`3kt5ouf4qxdkuzsct6zp3jxsqmtaqjsun3uvfdwbeuo2yizjp73ripyd.onion`
	No	2026-10-14T12:37:46		`7t635vqx6zm733ryjj5jm6hnavlw2it3umi3zmbq6gd6nhaeaylsbsyd.onion`
	No	2026-10-11T12:45:30		`73klffkonzmo6csfca75k67rniemcvlc2ydnfnkk54cqnkmdk2yqxqad.onion`
	No	2026-10-14T09:09:25		`olpvpdu4dotl54dereuembantzyjqzftjqj2ovvlfgcvw23qknuxzjad.onion`
	No	2026-10-13T18:38:20		`wsw3zgmaw32cjt4j4iwwpg7td7qgrh2fp2p34pvhupyqke6ilepsnqad.onion`
	No	2026-10-14T00:41:53		`6cs2fy7brjjx3fza7ny2vyhbkaxtn6rdx4p4js2lbgyhke7z4aslxtid.onion`
	No	2026-10-10T23:12:41		`vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd.onion`
	No	2026-10-14T12:37:49		`rngjexyyyl5mek5kg2lkxilqfef5nr6bpa4u24i5ei5hb3ydsh5drpid.onion`
	No	2026-10-14T12:35:09		`tamvd5fdyvpekhaf2sdg5sum73ra2abc4h2iqihijpvw4hythnlmuhid.onion`
	No	2026-10-13T18:39:55		`jolfnfw6lmcjsppgjfimhimqt2t7viybk67yc5zkxip6fxrcgo7mv4id.onion`
	No	2026-10-10T17:05:05		`qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd.onion`
Index of /	Yes	2026-10-10T21:12:30	nginx 1.27.3	`qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd.onion`
Index of /	Yes	2026-10-10T22:11:51	nginx 1.27.3	`p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad.onion`
	No	2026-10-10T17:05:05		`ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd.onion`
Index of /	Yes	2026-10-14T02:43:00	nginx 1.27.3	`5dw7bszmidrhpoltqbqmpixpz6mvgez3mr6xc7ktval2glrmbxkwopad.onion`
	No	2026-10-13T16:36:56		`4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad.onion`
	No	2026-10-14T08:11:17		`z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd.onion`
	No	2026-10-10T17:05:05		`7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad.onion`
	No	2026-10-10T17:05:05		`y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onion`
	No	2026-10-14T12:39:23		`wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd.onion`
	No	2026-10-14T04:12:03		`76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
placeholder placeholder	placeholder placeholder	s4killer (Minifilter Driver) placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	BCDEdit ServiceControl (sc.exe)	placeholder placeholder

YARA Rules (1)

Indicators of Compromise (IoCs) (27)

Hash MD5 18 Mutex 8 Tox 1

Type	IOC
`Hash MD5`	`04f724ede202f84bd8eddccc234eded3`
`Hash MD5`	`19aa99fe75f60f40e778366af1ef97b0`
`Hash MD5`	`21353d65b457518570bffc8a03038ee0`
`Hash MD5`	`3a91156c46a8b3b9a0591c9de52a8a73`
`Hash MD5`	`3aaf5ce520c9dcd4a858c2317eb1b328`
`Hash MD5`	`3f61f34bfd81d185be0d3d84b0c9baa7`
`Hash MD5`	`5d55fb708834d5ccde15d36554ea63e8`
`Hash MD5`	`5d70e359d4f086f31395cf935a620265`
`Hash MD5`	`6423278e10df9cff9514e8bfc6517289`
`Hash MD5`	`6c40aa0662e6d774b6fed9cbb4a14def`
`Hash MD5`	`8c8c93a6b6c6d6e632a54877fc1a209e`
`Hash MD5`	`9262153dbaf6933aa73923d17e475728`
`Hash MD5`	`92b93cb23dafbb49305910fda4a58be7`
`Hash MD5`	`b5085da2a8ecd8f74b66bfc6293f3acf`
`Hash MD5`	`c849b831d24baa677aec367fdeec2718`
`Hash MD5`	`df8aa27526a049320eba122d1bea5346`
`Hash MD5`	`f0ac3999d4020cd051052a0627a2056d`
`Hash MD5`	`f13a40e8a94aadc0e9f71204cb300aa7`
`Mutex`	`Global\G{C4F406E5-F024-4e3f-89A7-D5AB7663C3CD}`
`Mutex`	`Global\KissMeHardBeforeYouGo`
`Mutex`	`Global\WakeMeUpWhenItsAllOver`
`Mutex`	`Global\\x63fa\x308c\x305f\x6b6a\x3093\x3060\x4e16\x754c\x306b\x3060\x3093\x3060\x3093\x50d5\x306f`
`Mutex`	`Global\揺れた歪んだ世界にだんだん僕は`
`Mutex`	`LoadUpOnGunsBringYourFriends`
`Mutex`	`\KernelObjects\BcdSyncMutant`
`Mutex`	`\Sessions\1\BaseNamedObjects\_SHuassist.mtx`
`Tox`	`9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47`

Victims (41)

gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local