Embargo
A Rust-based ransomware operation, assessed by ESET to run as ransomware-as-a-service, that disables security tools before encrypting. TRM Labs says it may be a successor to BlackCat, though that is not proven.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
ESET documented two Rust tools: a loader it named MDeployer and an EDR killer it named MS4Killer. MS4Killer is compiled for each victim, targets one vendor's processes and abuses a vulnerable signed driver. A loader variant reboots systems into Safe Mode, where security tools can be renamed out of the way.1
TRM Labs says Embargo may be a rebrand of or successor to BlackCat, citing Rust, a similar leak site and on-chain overlaps. It also traced about US$34.2 million of incoming transactions it says are likely associated with the group.3 ESET assumes the group is a ransomware-as-a-service provider based on its sophistication and leak site.1
TRM Labs says targeting likely favours healthcare, business services and manufacturing, because of their need for uptime, and that most victims are in the US, with others in Europe and Asia.3 The sources do not establish a UK link.
Embargo's main lesson is that endpoint tools can be switched off on purpose. We would watch for boot configuration changes and driver loads, and not assume EDR will see the last stage.
How It Attacks
Based on ESET's analysis of incidents in 2024.1 Initial access is from TRM Labs.3
- 1
Get In
Exploits unpatched software or uses social engineering, according to TRM Labs.
- 2
Deploy the Loader
An already elevated account schedules a task to run MDeployer, which decrypts the payloads.
- 3
Disable Defences
Runs MS4Killer, abusing a vulnerable driver. A variant reboots into Safe Mode to disable security products.
- 4
Steal and Encrypt
Encrypts files and threatens to publish stolen data on a leak site.
- 5
Clean Up
Deletes payloads and reboots.
Key Techniques
Selected from the ATT&CK v20 entry for Embargo software.2
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1053.005 | Scheduled Task | Persistence | Creates a scheduled task to run the loader. |
| T1543.003 | Windows Service | Persistence | Creates a service that runs the loader in Safe Mode. |
| T1688 | Safe Mode Boot | Defense Impairment | Uses Safe Mode to disable security solutions. |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation | MS4Killer delivers a vulnerable driver. |
| T1489 | Service Stop | Impact | Stops services and processes from a hardcoded list. |
| T1490 | Inhibit System Recovery | Impact | Clears the Recycle Bin and disables Windows recovery. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files for ransom. |
| T1657 | Financial Theft | Impact | Extorts victims with stolen data and encryption. |
Key Events
Emerges. TRM Labs says around April,3 and ESET first saw it in telemetry in June.1
ESET publishes its toolkit analysis.1
TRM Labs publishes its transaction analysis and BlackCat assessment.3
Comparitech reports further claims, including an attack on a Dutch healthcare technology company that it says was confirmed.4,5
Warning Signs
Drawn from ESET and ATT&CK.1,2 None of these proves an attack alone.
- Unexpected reboots into Safe Mode
- Boot configuration changes made with bcdedit
- New scheduled tasks or services running unfamiliar loaders
- Security product directories renamed
- A newly loaded driver signed with a revoked certificate
Defences That Matter
Defend the Defences
- Enable tamper protection on endpoint tools.
- Use Microsoft's vulnerable driver blocklist and alert on new kernel drivers.
Patch What Faces the Internet
- Keep an accurate list of internet-facing systems and patch them first.
- Prioritise VPN appliances, file transfer tools and web applications.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Plan for Extortion
- Decide in advance who handles legal, regulatory and client communication if data is published.
- Rehearse a data theft scenario where backups do not solve the problem.
Would Your EDR Survive a Safe Mode Reboot?
We can test how your endpoint protection holds up against the techniques in this profile.
Sources
- ESET: Embargo ransomware: Rock'n'Rust, 23 October 2024
- MITRE ATT&CK: Embargo (S1247), ATT&CK v20
- TRM Labs: Unmasking Embargo ransomware, 8 August 2025
- Comparitech: Ransomware roundup, March 2026, 1 April 2026
- Comparitech: Ransomware roundup, April 2026, 5 May 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.