Threat intelligence / Malware

Embargo

[Embargo](https://attack.mitre.org/software/S1247) is a ransomware variant written in Rust that has been active since at least May 2024.(Citation: Cyble Embargo Ransomware May 2024)(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) ransomware operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid.(Citation: Cyble Embargo Ransomware May 2024)(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) ransomware has been known to be delivered through a loader known as MDeployer which also leverages a malware component known as MS4Killer that facilitates termination of processes operating on the victim hosts.(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) is also reportedly a Ransomware as a Service (RaaS).(Citation: ESET Embargo Ransomware October 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Embargo](https://attack.mitre.org/software/S1247) is a ransomware variant written in Rust that has been active since at least May 2024.(Citation: Cyble Embargo Ransomware May 2024)(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) ransomware operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid.(Citation: Cyble Embargo Ransomware May 2024)(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) ransomware has been known to be delivered through a loader known as MDeployer which also leverages a malware component known as MS4Killer that facilitates termination of processes operating on the victim hosts.(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) is also reportedly a Ransomware as a Service (RaaS).(Citation: ESET Embargo Ransomware October 2024)

Labels

malware

23 recorded

Relationships

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Financial Theft

Technique

uses

to Inhibit System Recovery

Technique

uses

to Modify Registry

Technique

uses

to Mutual Exclusion

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Safe Mode Boot

Technique

uses

to Scheduled Task

Technique

uses

to Selective Exclusion

Technique

uses

to Service Execution

Technique

uses

to Service Stop

Technique

uses

to System Service Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

uses

from Storm-0501

Group

3 external

References

mitre-attack

S1247

Cyble Embargo Ransomware May 2024

https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/

ESET Embargo Ransomware October 2024

https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/