Embargo Ransomware Laundered $34.2M in Crypto from U.S. Hospitals Since April

A new ransomware-as-a-service (RaaS) group known as Embargo has laundered approximately $34.2 million in cryptocurrency since emerging in April 2024, primarily targeting U.S. healthcare institutions with ransom demands reaching up to $1.3 million [1]. The group has reportedly victimized several U.S. hospitals, including American Associated Pharmacies, Memorial Hospital and Manor in Georgia, and Weiser Memorial Hospital in Idaho [1]. TRM Labs has identified technical and operational similarities between Embargo and the now-defunct BlackCat (ALPHV) ransomware group, including shared use of the Rust programming language, nearly identical data leak site designs, and overlapping wallet infrastructure [1].

Operating under a RaaS model, Embargo provides affiliates with advanced tools for execution while retaining control over key infrastructure, including payment negotiations and public pressure tactics through data leak sites [1]. The group’s approach is distinct from more high-profile ransomware actors like LockBit or Cl0p, as it avoids overt branding and high-visibility tactics, potentially allowing it to remain under the radar of law enforcement [1]. Embargo leverages artificial intelligence and machine learning to enhance its operations, including the generation of phishing emails and automated drive-by downloads to gain initial access to systems [1].

Once inside a network, the group deploys a two-stage toolkit to disable security measures and eliminate recovery options before encrypting files. It also employs double extortion by exfiltrating sensitive data and threatening to leak or sell it on the dark web if ransoms are not paid [1]. The data leak sites used by Embargo often publicize victim names and sensitive data, creating additional pressure on organizations to comply with ransom demands [1].

To launder the stolen funds, Embargo uses complex networks involving intermediary wallets, high-risk exchanges, and sanctioned platforms such as Cryptex.net. TRM Labs has tracked approximately $13.5 million in deposits across multiple virtual asset service providers, with 17 transactions exceeding $1 million routed through Cryptex.net between May and August 2024 [1]. The group avoids using traditional mixers or cross-chain bridges, instead layering transactions across multiple addresses before depositing funds directly into exchanges [1].

Approximately $18.8 million in victim funds remain dormant in unattributed wallets, potentially as part of deliberate evasion tactics to hinder tracking or delay movement until external conditions are more favorable [1]. These patterns align with a broader surge in crypto-focused cybercrime in 2025, including the $44.2 million breach at Indian exchange CoinDCX and the GreedyBear attack group’s $1 million theft via 150 weaponized Firefox extensions [1]. The Embargo attacks coincide with a broader trend of financially motivated cybercriminals adopting politically charged messaging, complicating attribution efforts and suggesting potential state-sponsored or aligned actors [1].

The rise of Embargo and similar groups underscores the growing sophistication of ransomware operations in targeting critical infrastructure and the challenges faced by law enforcement in tracking and disrupting such activities [1]. The group’s use of AI-enhanced techniques, combined with advanced laundering strategies, represents a significant evolution in the ransomware landscape [1].

Source:

[1] New Ransomware Group Embargo Launders $34M in Crypto from US Hospital Attacks Since April (https://cryptonews.com/news/new-ransomware-group-embargo-launders-34m-in-crypto/)