Embargo is a Rust-based ransomware-as-a-service operation that blinds endpoint security before it encrypts, first by killing EDR processes with a vulnerable signed driver and then, in some intrusions, by rebooting machines into Safe Mode where security tools do not run. MITRE ATT&CK tracks the malware as S1247 and records activity since at least May 2024. Primary research from ESET and Cyble documents the toolkit, and blockchain analytics firm TRM Labs assesses that Embargo may be a rebrand or successor of ALPHV (BlackCat). This profile is for SOC analysts, detection engineers and IT leaders in healthcare, manufacturing and business services, the sectors TRM reports as main targets. It stays at group level, summarises what the primary sources found and focuses on detection, prevention and response.
Key takeaways
- The toolkit is built to defeat your EDR. ESET describes a loader (MDeployer) and an EDR killer (MS4Killer) that abuses a vulnerable minifilter driver, compiled per victim to target only the security product present.
- Safe Mode is the bypass to watch. A DLL variant of the loader reconfigures boot to Safe Mode, disables Microsoft Defender there and runs itself via a service, which ATT&CK v20 maps to T1688 Safe Mode Boot.
- It is double extortion. Data is stolen before encryption and non-payers are listed on a leak site; TRM Labs reports demands of up to USD 1.3 million and about USD 34.2 million in likely related incoming transactions since around April 2024.
- The BlackCat link is an assessment, not a fact. TRM bases it on shared Rust use, a similar leak site design and overlapping wallet infrastructure, and words it as "may be".
- Driver and boot controls stop most of the chain. Microsoft's vulnerable driver blocklist, memory integrity, tamper protection, restricted local admin rights and alerts on boot configuration changes break the steps Embargo relies on.
Who they are
| Attribute | What primary sources report | Source |
|---|---|---|
| Name and ID | Embargo; ATT&CK software S1247 (ransomware) | MITRE ATT&CK |
| First seen | Public appearance May 2024; ESET telemetry from June 2024; TRM dates emergence to around April 2024 | ESET, TRM Labs |
| Language and platforms | Rust, which ESET notes allows Windows and Linux builds | ESET |
| Model | Ransomware-as-a-service: affiliates get tooling for a share of proceeds, while the core keeps infrastructure and negotiations | ESET, TRM Labs |
| Extortion | Double extortion; leak site; negotiation over its own infrastructure and Tox | ESET, Cyble |
| Possible lineage | May be a rebranded or successor operation to ALPHV (BlackCat); Cyble also noted the leak site closely resembles ALPHV's, which law enforcement took down in March 2024 | TRM Labs, Cyble |
| Targeting | Mainly US victims, some in Europe and Asia; healthcare, business services and manufacturing, including hospitals and a pharmacy network | TRM Labs, ESET |
Rebrands are common in ransomware, so treat lineage as context rather than a basis for defence. See the ALPHV BlackCat Threat Actor Profile for the predecessor's history, the Ransomware Family Lineage and Rebrands Guide for how rebrands work and the Ransomware Groups Guide for the wider landscape.
Attack chain at a glance
- Initial access: TRM reports exploitation of unpatched software and social engineering, including phishing and drive-by downloads. ESET saw one case where PowerShell resembling a WinRM file transfer tool delivered the loader (medium confidence), which implies remote administration access was already available.
- Staging: MDeployer decrypts two RC4-encrypted files from disk, one holding MS4Killer and one holding the ransomware, writes them under the Windows directory and logs to a file in C:\Windows\Debug. A scheduled task named Perf_sys ran the loader in every case ESET observed.
- Defence impairment: MS4Killer installs a vulnerable minifilter driver (probmon.sys version 3.0.0.4, signed with a revoked certificate; ESET reported no CVE) under service names such as Sysprox, Proxmon or Sysmon64, then loops over a hardcoded list of security product processes and terminates them. The DLL loader variant instead sets the machine to boot into Safe Mode, disables Microsoft Defender and the security tool there, and registers a service named irnagentd to resume after reboot. ESET also found a batch script using the same Safe Mode approach against a single product.
- Clean-up: the loader stops MS4Killer, deletes the decrypted payloads and dropped driver, writes a marker file to stop re-execution and forces a reboot.
- Impact: the ransomware stops database, mail, backup and remote access processes and services, empties the Recycle Bin, disables Windows automatic recovery, encrypts with ChaCha20 and Curve25519, appends a random six-character hexadecimal extension and drops HOW_TO_RECOVER_FILES.txt in each folder.
Tactics and techniques (MITRE ATT&CK v20)
The mappings below are taken from the ATT&CK S1247 entry. ESET's 2024 article used the older ID T1562.009 for Safe Mode Boot, which ATT&CK v20 has revoked in favour of T1688.
| Tactic | Technique | Embargo behaviour | Defensive focus |
|---|---|---|---|
| Execution | T1059.003 Windows Command Shell; T1569.002 Service Execution | Batch script to disable security tools; irnagentd service runs the loader after Safe Mode reboot | Alert on new services created by unusual parents |
| Persistence | T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder | Perf_sys task; irnagentd service registered to start in Safe Mode | Baseline scheduled tasks and Safeboot registry entries |
| Privilege escalation | T1068 Exploitation for Privilege Escalation | Bring your own vulnerable driver via MS4Killer | Vulnerable driver blocklist, memory integrity |
| Defence impairment | T1688 Safe Mode Boot; T1112 Modify Registry | Boot into Safe Mode; registry changes to disable Defender and add services | Alert on boot configuration and Safeboot key changes |
| Stealth | T1027.013 Encrypted/Encoded File; T1070.004 File Deletion; T1679 Selective Exclusion | RC4-encrypted payloads; payload and driver deletion; regex exclusions so the system still boots | File creation monitoring in C:\Windows and C:\Windows\Debug |
| Discovery | T1057 Process Discovery; T1007 System Service Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery | Finds security processes, running services and network shares to encrypt | Rarely actionable alone; correlate with the above |
| Impact | T1489 Service Stop; T1490 Inhibit System Recovery; T1486 Data Encrypted for Impact; T1657 Financial Theft | Stops backup and database services, disables recovery, encrypts, extorts | Immutable, offline backups; mass service stop alerts |
See the MITRE ATT&CK T1486 Data Encrypted for Impact guide for encryption-stage detection and the Bring Your Own Vulnerable Driver and EDR Killers Guide for the driver technique across families.
Where identity fits
Every step before encryption needs administrative rights: creating services and scheduled tasks, loading drivers, editing boot configuration and Safeboot registry keys. Embargo's chain therefore depends on compromised privileged accounts, whether a domain admin, a shared local administrator password or a remote management tool's service account. Unique local admin passwords (Windows LAPS), tiered admin accounts, removing standing admin rights and watching for remote administration from unusual sources all raise the cost of the chain. See the Recovering IAM and PAM After Ransomware or Domain Compromise guide for rebuilding trust afterwards.
Detection opportunities
| Signal | Data source | Notes |
|---|---|---|
| Boot configuration changed to Safe Mode (safeboot) or automatic recovery disabled | Process creation with command line (Sysmon Event ID 1 or Security Event ID 4688 with command line auditing) | Rare in normal operations; high-fidelity alert |
| New service named irnagentd, or any service set to start under the Safeboot keys | System Event ID 7045; registry monitoring of the Safeboot\Network and Safeboot\Minimal keys | Also watch for WinDefend changes under Safeboot |
| Scheduled task Perf_sys or a new task running a binary from C:\Windows | Security Event ID 4698; Task Scheduler Operational log | Name is victim-specific in future; hunt the pattern |
| Kernel driver load of probmon.sys, Sysprox.sys or Sysmon64.sys from an unusual path | Sysmon Event ID 6; EDR driver telemetry; CodeIntegrity Operational log | A file named Sysmon64.sys in C:\Windows is not the real Sysmon driver |
| Security agent processes terminating or going silent across hosts | EDR console health, SIEM heartbeat gaps | A device that stops reporting is an incident until proven otherwise |
| Unexpected reboots, especially into Safe Mode | System Event IDs 1074 and 6008; out-of-band management logs | Clusters of reboots outside change windows |
| Ransom note HOW_TO_RECOVER_FILES.txt or files gaining random six-hex extensions | File integrity monitoring, EDR file events | Late signal: isolate immediately |
File hashes, the driver certificate details and other indicators are in ESET's article. Indicators specific to this toolkit age quickly because MS4Killer is recompiled per victim, so prioritise behavioural detections. See Ransomware Early Warning Signs for pre-encryption hunting.
Prevention and hardening
- Enforce the vulnerable driver blocklist. Microsoft states the blocklist is on by default since the Windows 11 2022 update and is enforced when memory integrity (HVCI), Smart App Control or S mode is active, but not on Windows Server 2016. Confirm memory integrity is on, and for faster coverage deploy the downloadable blocklist through App Control for Business, testing in audit mode first and checking for CodeIntegrity Event ID 3099.
- Turn on tamper protection in your endpoint product and alert when it is changed. Make sure the product's own Safe Mode behaviour is understood and covered by its vendor documentation.
- Restrict who can change boot configuration. Remove standing local admin rights, use LAPS, and route admin work through privileged access workstations so the Safe Mode and driver steps need credentials that are hard to get.
- Patch internet-facing systems and remote access first, since TRM reports unpatched software as an entry route, and require phishing-resistant MFA on remote access and admin tooling.
- Protect backups from the service-stop stage. Keep immutable or offline copies with separate credentials, as the 3-2-1-1-0 Backup Rule Explained describes, and test restores.
- Watch for data theft before encryption. Alert on large outbound transfers from file servers, since leak site extortion follows exfiltration.
Prioritising by organisation size
Not every organisation can do everything at once. The controls below are ordered by how directly they break the Embargo chain described by ESET, weighed against effort.
| Control | Small organisation (no SOC) | Large organisation (SOC, EDR, SIEM) |
|---|---|---|
| Vulnerable driver blocklist and memory integrity | Check the Windows Security app on each device and turn memory integrity on where hardware supports it | Enforce through device management and App Control for Business; report non-compliant devices weekly |
| Tamper protection | Turn it on in the endpoint product and lock the setting centrally | Enforce by policy and alert on any change |
| Admin rights | Remove day-to-day admin rights from user accounts; use LAPS for local admin | Tiered admin model, privileged access workstations, just-in-time elevation |
| Boot and service monitoring | Ask the managed service provider whether Safe Mode changes and new services raise alerts | Detection rules for boot configuration, Safeboot registry keys, Event ID 7045 and driver loads |
| Backups | One offline or immutable copy with credentials not stored on the network | Isolated backup identity, immutable storage, regular restore tests |
Small organisations without in-house monitoring should confirm in writing that their managed provider watches for agents going offline and for unexpected reboots, because those are the moments Embargo's toolkit works. Larger organisations should test their detections by having the red team or a purple team exercise simulate the behaviours (a driver load from an unusual path, a Safe Mode boot change, a mass service stop) in a lab, then measure time to alert. Useful metrics are the percentage of endpoints with memory integrity enforced, the percentage with tamper protection locked, mean time to detect an agent going silent, the number of standing admin accounts and the date of the last successful full restore test.
Response priorities
- Isolate early: any host where security agents stopped reporting, rebooted unexpectedly or loaded an unknown driver should be network-isolated before investigation.
- Preserve evidence: collect memory if possible, the C:\Windows\Debug folder, scheduled task and service definitions, registry hives and EDR telemetry before reimaging.
- Reset privileged credentials: assume the accounts used to create services and load drivers are compromised, including service accounts and remote management tool credentials.
- Check boot configuration on every host: machines left set to Safe Mode will keep bypassing security tools on each reboot.
- Payment and reporting: sanctions screening and reporting duties apply before any payment decision. See the Ransomware Payments and Sanctions Guide and the Ransomware Data Leak Site Listing Playbook.
Common failure patterns
- Assuming EDR will catch it: the toolkit is designed to terminate the specific product present, so EDR health monitoring matters as much as EDR alerts.
- Memory integrity left off: on devices where HVCI, Smart App Control or S mode is not active, the vulnerable driver blocklist is not enforced, and older servers may never have it.
- No alerting on boot changes: Safe Mode reconfiguration is rare and noisy, yet many SIEMs have no rule for it.
- Shared local admin passwords: one compromised password lets the loader run everywhere.
- Backups reachable from the domain: backup services are on the ransomware's stop list, and backup consoles using domain credentials fall with the domain.
- Chasing names instead of behaviour: file names, task names and mutexes have already changed between the Cyble and ESET analyses; behaviour-based rules last longer.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Malware and driver control | SI-3 Malicious Code Protection; CM-7 Least Functionality | PR.PS-05 | A.8.7 Protection against malware |
| Monitoring of security tool health and boot changes | SI-4 System Monitoring; CA-7 Continuous Monitoring | DE.CM-01 | A.8.16 Monitoring activities |
| Backup resilience | CP-9 System Backup | PR.DS-11 | A.8.13 Information backup |
Practitioner checklist
- Confirm memory integrity and the vulnerable driver blocklist are enforced on all Windows endpoints and supported servers.
- Enable endpoint tamper protection and alert on agents that stop reporting.
- Add SIEM rules for Safe Mode boot configuration, disabled automatic recovery and services registered under Safeboot keys.
- Hunt for the Perf_sys task, irnagentd service and probmon.sys, Sysprox.sys or Sysmon64.sys driver loads, then generalise to the patterns.
- Deploy Windows LAPS and remove standing local and domain admin rights.
- Patch internet-facing systems and enforce phishing-resistant MFA on remote access.
- Keep immutable or offline backups with separate credentials and test restores quarterly.
- Rehearse isolation, evidence collection and privileged credential reset for an EDR-blinding scenario.
Standards and references
- MITRE ATT&CK: Embargo (S1247)
- ESET Research: Embargo ransomware: Rock'n'Rust
- Cyble: The Rust Revolution: New Embargo Ransomware Steps In
- TRM Labs: Unmasking Embargo Ransomware: TTPs and BlackCat Links
- Microsoft Learn: Microsoft recommended driver block rules
- MITRE ATT&CK: T1688 Safe Mode Boot
Related NHI Mgmt Group resources: Ransomware Groups Guide · ALPHV BlackCat Threat Actor Profile · MITRE ATT&CK T1486 Data Encrypted for Impact · Bring Your Own Vulnerable Driver and EDR Killers Guide