Embargo Ransomware Group Amasses $34.2 Million in One Year, Suspected Ties to BlackCat

The Embargo ransomware group has extracted $34.2 million from victims since its emergence in April 2024, targeting sectors like healthcare, business services, and manufacturing. U.S.-based entities bear the brunt of attacks, with ransoms soaring to $1.3 million per incident. High-profile victims include American Associated Pharmacies and multiple hospitals.

TRM Labs reports $18.8 million in stolen funds lying dormant in unattributed wallets. Technical parallels—use of Rust programming language and nearly identical data leak sites—suggest Embargo may be a rebranded iteration of the defunct BlackCat group. On-chain analysis reveals cryptocurrency flows from historical BlackCat addresses to wallets linked to Embargo victims.

Operating under a ransomware-as-a-service model, Embargo equips affiliates with tools while controlling Core operations and negotiations. This framework enables rapid expansion across industries and geographies.