Embargo

Active

Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.

41 Victims

Apr 17, 2024 First Discovered

Sep 9, 2026 Last Discovered

52 Days Inactive

0% Infostealer

4/42 Sites Online

Known Locations (42)

g7hva5likuonhljhh3sp2nvg7pezpu45vpxjccgihevwpb4fi2napqad.onion

76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd.onion

22g3uiuyqqa4txxuyvzmlyvlou4crrgfvgnvodrv3wrxcedtvjgx6aid.onion

kk3puzzmu6jfzll6sllchr5olxf4bg4tl7uyq7wtiqqpntkreya3qxqd.onion

qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd.onion

fanr4dyego253yx5pmbc7krct6qzq3hqfrchvj5fafiwalvjijfgsmid.onion

n56t64ldkhzygjk5cqa2f3r4xxjqzaftusjy56z25qcnun6ab4cijeqd.onion

vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd.onion

rngjexyyyl5mek5kg2lkxilqfef5nr6bpa4u24i5ei5hb3ydsh5drpid.onion

4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad.onion

dr4zejrunmmijebc4jhz6xwplapeltdqdchvbvikiwitvrtjedcezmad.onion

3kt5ouf4qxdkuzsct6zp3jxsqmtaqjsun3uvfdwbeuo2yizjp73ripyd.onion

wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd.onion

Index of /

byodkksxj3pdnn4dvkouo6oshztjgc45accwvbd7e53heil7s2tfrtyd.onion

olpvpdu4dotl54dereuembantzyjqzftjqj2ovvlfgcvw23qknuxzjad.onion

jolfnfw6lmcjsppgjfimhimqt2t7viybk67yc5zkxip6fxrcgo7mv4id.onion

7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad.onion

z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd.onion

7t635vqx6zm733ryjj5jm6hnavlw2it3umi3zmbq6gd6nhaeaylsbsyd.onion

7jkcp27353enwfwdemqgsevyjbtz5cxv66n5ctfgd37h2mdxbhhiluyd.onion

y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onion

rlseptkjo5yt2c3m4ov7hmhxmb2uia3cic3ohq2u5tmb2uv4enovhfid.onion

wsw3zgmaw32cjt4j4iwwpg7td7qgrh2fp2p34pvhupyqke6ilepsnqad.onion

orxo6qmizqa43suoox3xteu6645y4zf2bpvnsutb2yq3n2lpprw2x7yd.onion

tamvd5fdyvpekhaf2sdg5sum73ra2abc4h2iqihijpvw4hythnlmuhid.onion

6cs2fy7brjjx3fza7ny2vyhbkaxtn6rdx4p4js2lbgyhke7z4aslxtid.onion

73klffkonzmo6csfca75k67rniemcvlc2ydnfnkk54cqnkmdk2yqxqad.onion

EMBARGO

embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion

Index of /

p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad.onion

Index of /

ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd.onion

Index of /

yunznlzrpp7oa45og6unujpp4t3f4m2sqh2b4vuhct3kmbxxj6lwqbqd.onion

Index of /

qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd.onion

Index of /

clqt3b3ldzxyemjrkvgsm5so2tyus7f7i2ia5qvikt4623srq5w3d7ad.onion

Index of /

5dw7bszmidrhpoltqbqmpixpz6mvgez3mr6xc7ktval2glrmbxkwopad.onion

Index of /

nbgvwttzh35irjtnxgeaydqob6ixorgabbufb4ociefv4zklyppu5lad.onion

Index of /

katqzwogbio5ro3glh4k5cmbz2zxeac5az2pebzg4e6n7gw66di7ihad.onion

Index of /

gvhj726josrtcuig76yfme5x72d7xqbevgsqm26ua3qcmskxddnx3oid.onion

Index of /

v6pggtfljylf5cekfssrdhcyaxsk6m5xoudrqnvskw73iueyvaexsnad.onion

Index of /

rdur3c3dxhjjpfxebaiba6fuj6lqrcdtqfzengynkg5ptyelcclgvdid.onion

Index of /

fvbobs6fcm5lske2xhfyx5sazn3i5cbxrbdyozoio23ouhnmortg5fyd.onion

Index of /

bjy6kwjxxepe6v3vjlxhir4qzdpl7jvwvxua6wvemyfm44di2cxdd4qd.onion

Index of /

zs3swtx3pkpi6qy3umpei5ophcvblu6zo3uwi3v2zda7h4lv2iup2iqd.onion

Tools Used

DefenseEvasion

s4killer (Minifilter Driver)

LOLBAS

BCDEdit, ServiceControl (sc.exe)

Intelligence

📄 2 Ransom Notes
View the actual ransom notes used by this group →

Victims (41)

Detailed victim list temporarily unavailable

This group has 41 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.