Embargo Ransomware Group Moves $34M in Crypto Since April, TRM Reports

TRM Labs has reported that the Embargo ransomware group has moved approximately $34 million in cryptocurrency since April 2024, highlighting its growing presence in the cybercrime landscape [1]. Operating under a ransomware-as-a-service (RaaS) model, Embargo has targeted critical U.S. infrastructure, including hospitals and pharmaceutical networks. Victims include American Associated Pharmages, Georgia-based Memorial Hospital, and Weiser Memorial Hospital in Idaho, with ransom demands reaching up to $1.3 million [1].

TRM’s investigation suggests that Embargo may be a rebranded version of the BlackCat (ALPHV) operation, which disappeared earlier this year following a suspected exit scam. The two groups share technical similarities, including the use of the Rust programming language and similar data leak site structures, as well as onchain ties through shared wallet infrastructure [1]. TRM’s Graph Visualizer has been used to trace these connections, revealing overlapping wallet activity between the two groups.

Around $18.8 million of the funds remain dormant in unaffiliated wallets, a tactic experts believe could be used to delay detection or take advantage of better laundering conditions in the future. Embargo has also been observed using a network of intermediary wallets and high-risk platforms, including the sanctioned exchange Cryptex.net, to obscure the source of the funds. From May through August, TRM traced at least $13.5 million across various virtual asset service providers, with over $1 million passing through Cryptex alone [1].

The group employs double extortion tactics, encrypting systems and threatening to leak sensitive data if victims refuse to pay. In some cases, Embargo has publicly named individuals or leaked data to apply additional pressure on targets. Its primary focus has been on sectors where system downtime is costly, such as healthcare, business services, and manufacturing, with a clear preference for U.S.-based targets, likely due to their higher capacity to pay [1].

While not as visibly aggressive as LockBit or Cl0p, Embargo demonstrates the continued adaptability and persistence of ransomware actors. The rebranding and reuse of infrastructure by former cybercriminal groups show the difficulty of permanently disrupting such operations. TRM Labs’ findings underscore the need for enhanced blockchain monitoring and international cooperation to track and mitigate the financial flows of ransomware operations.

Source: [1] Embargo ransomware group moved $34M in crypto since April (https://cointelegraph.com/news/embargo-ransomware-34m-crypto-blackcat-links)