Threat Intelligence Report May 27 - June 2 2025

EMBARGO Ransomware

EMBARGO is a relatively new ransomware group that emerged in 2024 and operates under a ransomware-as-a-service (RaaS) model. The group develops Rust-based ransomware payloads and provides them to affiliates (such as the threat actor tracked as Storm-0501) for execution. EMBARGO employs double-extortion tactics – stealing sensitive data before encrypting systems – to pressure victims into paying not only for decryption but also to prevent data leaks. The group maintains a Tor-based leak site to publish stolen data if ransoms are not paid, and claims to be an “international team without any political affiliations,” focusing purely on criminal extortion.

Tactics, Techniques, and Procedures (TTPs):

Defence Evasion & Custom Tooling:
EMBARGO deploys a sophisticated toolkit featuring two Rust-based components, MDeployer (loader) and MS4Killer (EDR killer). MS4Killer is uniquely tailored per victim and abuses Safe Mode along with a "Bring Your Own Vulnerable Driver" (BYOVD) technique to disable AV/EDR at the kernel level, often leveraging outdated drivers like ProcMon.sys. It loops continuously to kill respawning security processes.

Advanced Evasion Tactics Include:

• Safe Mode Abuse (T1562.009) – Disables most defences by forcing boot into Safe Mode.
• BYOVD Exploits (T1211) – Drops vulnerable drivers for privileged access.
• Malicious WDAC Policy Abuse – Weaponises Microsoft’s allowlisting to blind EDR.
• Self-deletion (T1070.004) – Ransomware removes itself post-execution.
• Obfuscated Code & Encrypted Strings (T1140) – Hinders reverse engineering.
• Living-off-the-Land – Uses tools like PowerShell, WMIC for stealth.
  
  

Initial Access & Lateral Movement:
Access vectors likely include phishing, stolen credentials, and MSP/supply-chain compromise. Once inside, EMBARGO conducts reconnaissance, dumps credentials, and moves laterally—typically achieving domain admin access before encryption.

Execution & Persistence:
Payloads are staged via MDeployer, which decrypts MS4Killer and the final ransomware payload in memory (e.g., pay.exe). Safe Mode boot configurations and registry run keys are used to maintain persistence across reboots.

Exfiltration & Impact:
EMBARGO exfiltrates sensitive data prior to encryption (e.g., via secure FTP/cloud). Data theft is followed by fast encryption using ChaCha20 with Curve25519 ECC keys. It disables Volume Shadow Copies (T1490) to prevent recovery. Victims are given 3–7 days before data is leaked, with ransom demands handled via Tor-based portals.

Detailed TTPs

IOCs.

TOX:
9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47

Ransom Note Filename
HOW_TO_RECOVER_FILES.txt

Encrypted File Extension:  .564ba1 (original variant); or 6-hex random (e.g. .b58eeb)

No latest malware sample was found publicly.

Associated Tools:
MDeployer, MS4Killer

Mitigation
Block/alert on the seven new onion hostnames at egress proxies, Tor gateways and DNS-layer firewalls.

1. Hunt for Safe-Mode reboots initiated from domain-admin-level accounts in Windows event logs — still the earliest reliable on-host sign of an impending EMBARGO detonation.
2. Driver block-rules: ensure Microsoft’s vulnerable-driver blocklist (or equivalent EDR feature) is enabled to blunt MS4Killer’s BYOVD payload (confirmed effective in Beazley’s Feb 2025 incident).
3. Monitor WDAC policy pushes; any unsigned or suddenly restrictive policy appearing between 24 May and 2 Jun warrants immediate review.
4. Verify offline backups + immutable snapshots; shadow-copy deletion remains unchanged.

Crystal Eye (CE) helps protect against ransomware by preventing initial infection and blocking malicious communications. At the network level, CE’s integrated firewall and intrusion prevention system (IPS) inspect all inbound and outbound traffic, using up-to-date threat intelligence feeds to block ransomware command-and-control (C2) domains and known malicious URLs before they reach endpoints.

CE also enforces network segmentation and secure web-filtering, ensuring that if an attacker manages to introduce ransomware, lateral movement is constrained, and drive-by downloads via phishing links are automatically intercepted.

Additionally, CE’s Data Loss Prevention (DLP) features tag and audit sensitive files, preventing critical data from being exfiltrated if encryption begins.

On the host side, CE’s Endpoint Detection and Response (EDR) capabilities continuously monitor processes and file changes for ransomware‐typical behaviors (e.g., rapid file encryption, shadow-copy deletion) and immediately isolate compromised hosts at the network layer to stop further spread.

CE’s automated playbooks coordinate real-time responses—quarantining suspicious files, killing malicious processes, and pushing emergency patching—to contain threats the moment ransomware is detected.

Furthermore, CE maintains immutable backups and forensically logs all events, enabling rapid recovery of encrypted data and complete post-incident analysis to ensure any lingering traces of ransomware are eradicated.

Ransomware Victims Worldwide

The United States remains the epicentre of ransomware activity, accounting for a staggering 52.59% of all reported victims last week. Its extensive digital infrastructure, complex supply chains, and vast economic influence continue to make it the most heavily targeted nation globally.

Canada follows at 7.76%, highlighting the persistent targeting of North American infrastructure, particularly organisations with deep technological integration and cross-border operations.

Australia ranks next with 5.17%, underscoring the country's position as a key economic player in the Asia-Pacific region and an increasingly attractive target for ransomware operators due to its strong adoption of cloud services and digital transformation.

Italy reported 4.31%, reflecting ongoing ransomware pressure on European nations with rich industrial and commercial ecosystems.

The United Kingdom and Germany each registered 2.59%, suggesting continued targeting of financial institutions, government entities, and professional services, often interconnected with U.S.-based networks.

Spain, Belgium, Mexico, and Taiwan each accounted for 1.72%, showing mid-level targeting across Western Europe, North America, and East Asia, regions often engaged in global trade and hosting critical business services.

A large group of countries, Slovenia, United Arab Emirates, Brazil, Argentina, Denmark, Switzerland, South Africa, Lithuania, Ireland, Philippines, Colombia, Thailand, India, Malaysia, Croatia, Czech Republic, South Korea, Indonesia, Peru, China, and Bulgaria, each experienced 0.86% of the total ransomware activity. This long-tail distribution reinforces ransomware’s truly global footprint, reaching economies both large and small, and spanning every inhabited continent.