Particle.news
Download on the App Store
6 ARTICLES
·
2w ago

Embargo Ransomware Tops $34.2 Million as Group Deploys AI-Driven Attacks

TRM Labs analysis shows that half of Embargo’s haul remains idle in dormant wallets, highlighting layered laundering tactics

Zachxbt
Blackcat with a new name? trm says the ransomware group may have rebranded to embargo
Image
Image

Overview

  • Embargo has processed $34.2 million in cryptocurrency since April 2024 by targeting U.S. healthcare, business services and manufacturing organizations.
  • TRM Labs found that $18.8 million of the group’s proceeds remain parked in unattributed wallets, a tactic designed to impede tracing and delay movement.
  • The operation runs as a Rust-based ransomware-as-a-service platform and employs AI-driven methods to craft phishing lures and adapt its malware.
  • On-chain data show funds funneled through intermediary wallets, high-risk exchanges and sanctioned services including Cryptex.net.
  • Policymakers in the U.K. and other countries are preparing to bar public-sector agencies from making ransom payments to curb infrastructure vulnerabilities.