Skip to main content
Darkfield

Operator dossier

Embargo is a ransomware operator currently active on public leak sites. Darkfield has indexed 40 public victims claimed by this operator between April 21, 2024 and June 30, 2026. Embargo is a ransomware group that emerged in April 2024, operating with primarily financial motivations and demonstrating a focus on high-value targets across multiple sectors. The group has been observed targeting victims predominantly in the United States, Singapore, India, and France, with particular emphasis on technology, healthcare, manufacturing, business services, and financial sectors. Given the group's recent emergence and limited public documentation from major threat intelligence sources, specific details about their country of origin, operational structure, and technical methodologies remain largely unconfirmed by established security research organizations. With 37 known victims identified since their emergence, Embargo appears to follow established ransomware operational patterns typical of financially-motivated cybercriminal groups, though comprehensive analysis of their attack vectors, encryption methods, and extortion tactics has not yet been extensively documented by major cybersecurity firms or government agencies. The group's targeting of critical infrastructure sectors including healthcare and financial services aligns with broader ransomware trends observed throughout 2024, though specific notable campaigns or high-profile attacks have not been widely reported in public threat intelligence reporting. As of current observations, Embargo appears to remain active, though the limited timeframe since their emergence and sparse public documentation makes definitive assessment of their operational status challenging without additional confirmed reporting from established threat intelligence sources.

Most-targeted sectors

Most-affected countries

Recent disclosures by Embargo

Most recent 39 of 40 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Embargo →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Embargo

40 victims indexed · first seen 2 years ago · last activity 15 days ago

40
Victims indexed
#121 of 364 tracked operators
2y 2m
Active period
Apr 2024 → Jun 2026
15
Countries hit
top United States · 23

At a glance

Status
active
First seen
2 years ago
Last activity
15 days ago
Onion sites
1 known endpoint
Primary sector
Technology · 10 hits

About

Embargo is a ransomware group that emerged in April 2024, operating with primarily financial motivations and demonstrating a focus on high-value targets across multiple sectors. The group has been observed targeting victims predominantly in the United States, Singapore, India, and France, with particular emphasis on technology, healthcare, manufacturing, business services, and financial sectors. Given the group's recent emergence and limited public documentation from major threat intelligence sources, specific details about their country of origin, operational structure, and technical methodologies remain largely unconfirmed by established security research organizations. With 37 known victims identified since their emergence, Embargo appears to follow established ransomware operational patterns typical of financially-motivated cybercriminal groups, though comprehensive analysis of their attack vectors, encryption methods, and extortion tactics has not yet been extensively documented by major cybersecurity firms or government agencies. The group's targeting of critical infrastructure sectors including healthcare and financial services aligns with broader ransomware trends observed throughout 2024, though specific notable campaigns or high-profile attacks have not been widely reported in public threat intelligence reporting. As of current observations, Embargo appears to remain active, though the limited timeframe since their emergence and sparse public documentation makes definitive assessment of their operational status challenging without additional confirmed reporting from established threat intelligence sources.

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

17 months
2024-04-01T00:00:00+00:00 · 22024-05-01T00:00:00+00:00 · 32024-06-01T00:00:00+00:00 · 12024-07-01T00:00:00+00:00 · 42024-09-01T00:00:00+00:00 · 12024-11-01T00:00:00+00:00 · 52025-01-01T00:00:00+00:00 · 12025-02-01T00:00:00+00:00 · 42025-03-01T00:00:00+00:00 · 22025-05-01T00:00:00+00:00 · 32025-06-01T00:00:00+00:00 · 22025-08-01T00:00:00+00:00 · 12025-09-01T00:00:00+00:00 · 12025-10-01T00:00:00+00:00 · 12025-12-01T00:00:00+00:00 · 12026-03-01T00:00:00+00:00 · 62026-06-01T00:00:00+00:00 · 1
2024-04-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
23
🇺🇸 United States
2
🇸🇬 Singapore
2
🇹🇼 Taiwan
1
Lesotho
1
🇮🇳 India
1
🇫🇷 France
1
🇬🇧 United Kingdom
1
United States dossier →United States dossier →Singapore dossier →Taiwan dossier →

Top sectors

Technology
10
Healthcare
7
Manufacturing
5
Business Services
4
Government
2
Financial
2
Transportation/Logistics
2
Financial Services
2
Technology dossier →Healthcare dossier →Manufacturing dossier →Business Services dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion

Source

Updated 15 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Embargo posts a victim.

Add Embargo to your watchlist — Pro pings you within 5 minutes of any new Embargo leak-site post, Telegram callout, or affiliate-rebrand inference.