Embargo is a cybercriminal group operating under a Ransomware-as-a-Service (RaaS) model, first observed in June 2024. The group provides affiliates with the necessary tools and infrastructure to conduct attacks, retaining control over core operations like payment negotiations. Embargo is suspected with moderate confidence to be of Russian origin and its primary motivation is financial gain, though some incidents have incorporated politically charged messages. The group is distinguished by its use of the Rust programming language for its custom malware and its aggressive double extortion tactics, which involve encrypting victim data while also exfiltrating sensitive information to pressure victims into paying, often threatening to leak data on dedicated sites. Embargo is assessed by some as a possible rebranded or successor operation to BlackCat (ALPHV), sharing technical and behavioral similarities.

Aliases del actor

Gothic PandaTG-0110lo que sugiere una operativa bien organizadaDeep PandaWebMastersApt19KungFu KittensGroup 13Sh3llCr3wPinkPantherWinnti Groupuna reputación de actividad prolongadaDagger PandaIceFogFucobhaTempSneaky PandaHydraqSIG22Elderwood GangG0066AuroraElderwood Projecteste grupo se destaca por su actividad en el sector privadotransporte marítimoaeronáuticaarmasenergíaobtención de credencialesen análisis de amenzasG0073Bassos Campaign o Derusbi

Actores similares

Conquerors Electronic Armyapt · 0Operation DRBControlapt · 0Eloquent Pandaapt · 0eloquent-pandaactor · 1PhantomControlapt · 0Container Orchestration Jobactor · 1Gamaredon Groupthreat-actor · 1redcontroleactor · 1LUNAR SPIDERapt · 0apt-desertfalconactor · 1

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker