Embargo Ransomware Demands $1.3M from U.S. Hospitals in New Crypto Payments Surge

A new ransomware group named Embargo has emerged in the cybercrime landscape, quickly amassing over $34 million in cryptocurrency-linked ransom payments since April 2024, according to blockchain intelligence firm TRM Labs [1]. The group operates under a ransomware-as-a-service (RaaS) model, targeting critical infrastructure in the United States, including hospitals and pharmaceutical networks. Among its victims are American Associated Pharmacies, Memorial Hospital and Manor in Georgia, and Weiser Memorial Hospital in Idaho, with ransom demands reaching as high as $1.3 million [1].

TRM Labs has suggested that Embargo may be a rebranded version of the previously prominent ransomware group BlackCat (ALPHV), which disappeared earlier this year amid a suspected exit scam. The two groups share similarities, including their use of the Rust programming language, nearly identical data leak sites, and overlapping cryptocurrency wallet infrastructure [1].

Embargo has employed double-extortion tactics, not only encrypting victims’ systems but also threatening to release stolen data if ransom demands are not met. In some instances, the group has publicly named individuals or leaked sensitive files to increase pressure on victims to pay [1]. The group’s focus has been on sectors where operational downtime is costly—specifically U.S.-based healthcare, manufacturing, and business services, which are viewed as having a higher capacity to pay [1].

According to TRM’s analysis, approximately $18.8 million in Embargo’s ransom proceeds remains untouched in dormant wallets. This could be a deliberate strategy to evade detection or to wait for more favorable conditions for laundering the funds [1]. The group has routed a significant portion of its proceeds through a network of intermediary wallets, high-risk exchanges, and sanctioned platforms such as Cryptex.net. Between May and August, investigators traced at least $13.5 million through various virtual asset service providers, including more than $1 million sent via Cryptex [1].

Despite a reported 35% decline in ransomware revenue in the past year—marking the first such decline since 2022, according to Chainalysis—TRM’s findings indicate that groups like Embargo are ensuring the threat remains substantial [1]. Meanwhile, the UK government is preparing to introduce a policy banning ransom payments by public sector organizations and critical national infrastructure operators, including healthcare and energy providers. The plan would also require mandatory incident reporting, with victims needing to notify authorities within 72 hours of an attack and submit a full report within 28 days [1].

Source:

[1] title: Emerging ‘Embargo’ Ransomware Group Linked to $34M in Crypto Payments

url: https://coinmarketcap.com/community/articles/68988c124aa6a72cbd7c7493/