Threat Group Profile
embargo
● Active — last 30 days
Victim claims
2
First seen
Jun 2026
Last activity
30 Jun 2026
Tracked since
—
Group overview
Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.
Preferred targets
Transportation/Logistics · 1
Construction · 1
Most targeted countries
US · 2
