Loading malware…
Embargo is a Rust-based ransomware family and ransomware-as-a-service operation, also tracked in some reporting as Storm-0501. First observed in 2024, it is associated with double-extortion intrusions in which operators exfiltrate victim data before encrypting systems to increase pressure for payment. Multiple assessments have linked the operation to the post-BlackCat/ALPHV ransomware ecosystem, and affiliate activity has been associated with financially motivated intrusion sets targeting higher-value organizations, including notable concentration in the United States and sectors such as technology and healthcare.
Embargo’s tooling commonly includes the MDeployer loader and the MS4Killer utility. MDeployer is used to decrypt and launch payloads, while MS4Killer is used to weaken endpoint protections and terminate targeted processes and services. A notable feature of Embargo operations is Safe Mode abuse for defense evasion and persistence: the malware has been observed modifying Windows configuration to ensure a malicious service launches after reboot in Safe Mode, allowing execution while many security products are inactive. It also establishes persistence through a scheduled task for the loader.
The ransomware supports extensive pre-encryption discovery and preparation. It enumerates processes, active services, device volumes, mounted and networked drives, and recursively searches folders and subfolders to identify encryption targets. It terminates selected processes and services, including security tooling, and has used a Bring Your Own Vulnerable Driver technique through MS4Killer to disable defenses at the kernel level. Additional anti-recovery behavior includes disabling Windows recovery features, clearing deleted-file artifacts, and removing temporary components after execution.
Embargo encrypts files using ChaCha20 with Curve25519 or X25519-based asymmetric key exchange and appends randomized hexadecimal extensions to encrypted files. It excludes selected files and directories from encryption through embedded filtering logic. Reported intrusion chains tied to Embargo affiliates include exploitation of known public-facing vulnerabilities, use of stolen credentials and access brokers, lateral movement with common post-exploitation frameworks and remote management tools, and data exfiltration to cloud storage services before ransomware deployment. The malware is therefore best characterized as a mature enterprise-targeting ransomware platform with strong defense-evasion, persistence, discovery, and extortion capabilities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Initial Access Primary (Storm-0501): Exploitation of known N-day vulnerabilities in internet-facing applications: CVE-2023-29300 / CVE-2023-38203 (Adobe ColdFusion) | Embargo Ransomware (Storm-0501) Type: Ransomware-as-a-Service (RaaS) - Open Affiliate Model
Embargo Ransomware (Storm-0501) Type: Ransomware-as-a-Service (RaaS) - Open Affiliate Model | Initial Access Primary (Storm-0501): Exploitation of known N-day vulnerabilities in internet-facing applications: CVE-2023-4966 (Citrix NetScaler - "Citrix Bleed")
Embargo Ransomware (Storm-0501) Type: Ransomware-as-a-Service (RaaS) - Open Affiliate Model | Initial Access Primary (Storm-0501): Exploitation of known N-day vulnerabilities in internet-facing applications: CVE-2023-29300 / CVE-2023-38203 (Adobe ColdFusion)
Embargo Ransomware (Storm-0501) Type: Ransomware-as-a-Service (RaaS) - Open Affiliate Model | Initial Access Primary (Storm-0501): Exploitation of known N-day vulnerabilities in internet-facing applications: CVE-2022-47966 (Zoho ManageEngine RCE)
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Embargo has obtained persistence of the loader MDeployer by creating a scheduled task named "Perf_sys."
Hastalamuerte was an experienced affiliate who had previously worked with Embargo, LockBit, and Medusa before joining Qilin.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
The content repeatedly describes adversaries and malware deleting files, directories, droppers, scripts, logs, archives, staged data, and other artifacts from compromised systems, e.g., 'APT29 has used SDelete to remove artifacts from victim networks' and 'Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.'
Embargo has utilized MDeployer to decrypt two payloads that contain MS4Killer toolkit b.cache and the Embargo ransomware executable a.cache with a hardcoded RC4 key.
Embargo has utilized a hardcoded mutex name of "LoadUpOnGunsBringYourFriends" using the CreateMutexW() function. Embargo has also utilized a hardcoded mutex name of "IntoTheFloodAgainSameOldTrip."
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
Embargo has obtained active services running on the victim’s system through the functions OpenSCManagerW() and EnumServicesStatusExW().
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
Embargo has searched for folders, subfolders and other networked or mounted drives for follow on encryption actions. Embargo has also iterated device volumes using FindFirstVolumeW() and FindNextVolumeW() functions and then calls the GetVolumePathNamesForVolumeNameW() function.
Embargo has searched for folders, subfolders and other networked or mounted drives for follow-on encryption actions.
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
Embargo has the ability to encrypt files with the ChaCha20 and Curve25519 cryptographic algorithms. Embargo also has the ability to encrypt system data and add a random six-letter extension consisting of hexadecimal characters such as ".b58eeb" or ".3d828a" to encrypted files.
Embargo has terminated active processes and services based on a hardcoded list using the CloseServiceHandle() function. Embargo has also leveraged MS4Killer to terminate processes contained in an embedded list of security software process names that were XOR-encrypted.
Examples include BlackByte performing Registry modifications to escalate privileges and disable security tools; LockBit 3.0 changing Registry values to disable SmartScreen and Windows Defender; TA505 using malware to disable Windows Defender through Registry modification.
BlackByte performed Registry modifications to escalate privileges and disable security tools. Embargo has modified and deleted Registry keys to add services, and to disable Security Solutions such as Windows Defender. TA505 has used malware to disable Windows Defender through modification of the Registry. During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, disabled security services via Registry modifications.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another ransomware operation previously observed using Safe Mode for defense evasion.
Named as one of the ransomware operations with which hastalamuerte reportedly had prior experience.
A ransomware group referenced as the prior operation with which LARVA-368 was associated before launching ArmCorp/The Gentlemen.
A named ransomware operation referenced as one of the affiliate programs previously used by The Gentlemen founder.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.