MITRE ATT&CKsoftware (malware)
S1247 Embargo
- Domain
- enterprise
- Platforms
- ESXi, Linux, Windows
- Version
- 1.0
- Created
- 2025-10-19
Description
Embargo is a ransomware variant written in Rust that has been active since at least May 2024. Embargo ransomware operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Embargo ransomware has been known to be delivered through a loader known as MDeployer which also leverages a malware component known as MS4Killer that facilitates termination of processes operating on the victim hosts. Embargo is also reportedly a Ransomware as a Service (RaaS).
Related
Uses · MITRE ATT&CK (22)
- T1688 Safe Mode Boot technique
- T1679 Selective Exclusion technique
- T1480.002 Mutual Exclusion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1657 Financial Theft technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1053.005 Scheduled Task sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1007 System Service Discovery technique
- T1057 Process Discovery technique
- T1068 Exploitation for Privilege Escalation technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G1053 Storm-0501 group
References
- https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/ Cyble Embargo Ransomware May 2024
- https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/ ESET Embargo Ransomware October 2024