Embargo Ransomware: BlackCat’s Heir Targets Healthcare, Rakes in $34M in Crypto

Embargo ransomware has quickly emerged as one of the most dangerous ransomware-as-a-service (RaaS) operations of the past year, amassing $34.2 million in cryptocurrency since April 2024. According to a detailed investigation by blockchain intelligence firm TRM Labs, the group is likely a BlackCat successor. It is reusing the notorious gang’s Rust-based code, laundering techniques, and even ransom note templates.

What makes Embargo stand out is not just its technical background, but its choice of victims. The group crippled hospitals and pharmaceutical networks across the United States with ransomware campaigns in the healthcare sector. The ransom demands reached as high as $1.3 million.

From BlackCat to Embargo: A Familiar Playbook

BlackCat, also known as ALPHV, burst onto the ransomware scene in late 2021. It built its reputation for innovation, large-scale attacks, and one of the first searchable leak portals for stolen data. At its peak in mid-2023, the group was demanding multi-million-dollar payments from critical infrastructure operators worldwide.

In December 2023, the FBI, working with Europol, seized parts of BlackCat’s infrastructure and delivered decryption keys to hundreds of victims. While the takedown was a blow, the group resurfaced briefly before its activity declined sharply in early 2024.

By April 2024, a new player, Embargo ransomware, appeared. Interestingly, researchers quickly noticed overlapping traits:

• Written in Rust, offering cross-platform capabilities and resistance to reverse-engineering.
• Leak site design and ransom notes are nearly identical to BlackCat’s.
• Cryptocurrency wallet activity mirrors BlackCat patterns.

TRM Labs now assesses with high confidence that Embargo is a direct successor of the BlackCat operation under a new brand.

How Embargo Operates

Embargo runs as a ransomware-as-a-service network. That means core operators develop the malware and manage the infrastructure while affiliates conduct attacks for a percentage of the ransom.

Key tactics include:

• Double extortion — encrypting files and threatening to leak stolen data.
• AI in ransomware — leveraging machine learning for intrusion detection evasion, phishing optimization, and automated data exfiltration.
• Advanced defense evasion techniques to bypass endpoint detection and response (EDR) systems.

This combination makes Embargo one of the most technically sophisticated healthcare ransomware actors in operation today. Unfortunately, it’s a prime example of how the double extortion model has evolved to integrate AI-driven enhancements.

Healthcare and Pharmaceuticals in the Crosshairs

While Embargo’s victims span multiple industries, its most visible impact has been on U.S. healthcare and pharmaceutical organizations. Notable incidents include:

• Memorial Hospital and Manor (Georgia)
• Weiser Memorial Hospital (Idaho)
• American Associated Pharmacies

In these attacks, ransom demands have ranged from hundreds of thousands to over $1.3 million, often followed up by threats to leak sensitive patient data. Hospitals are particularly vulnerable because downtime directly impacts patient care, creating intense pressure to pay quickly.

Following the $34 Million Trail

TRM Labs’ blockchain analysis reveals that Embargo has moved approximately $34.2 million in crypto ransom payments through a complex laundering network.

Notable patterns include:

• Using intermediary wallets to obscure the source of funds.
• Leveraging sanctioned exchanges such as Cryptex.net.
• Parking $18.8 million in dormant wallets to avoid immediate detection.

Experts note that this kind of crypto laundering, which combines intermediary wallet hops with jurisdictional arbitrage, is consistent with laundering strategies BlackCat operations used until the 2023 takedown. In fact, Embargo’s methods also illustrate how crypto laundering has become more sophisticated to neutralize blockchain tracing efforts.

Law Enforcement and Industry Response

Cybersecurity experts note that Embargo’s rapid rise underscores the resilience of ransomware networks even after high-profile disruptions. The transition from BlackCat to Embargo highlights how quickly affiliates can regroup under a new banner, reusing infrastructure and tactics.

For healthcare ransomware prevention, analysts recommend:

• Segmenting networks to limit lateral movement.
• Implementing multi-factor authentication across all remote access points.
• Regularly backing up critical systems offline.
• Training staff to detect phishing attempts.

Law enforcement agencies are monitoring Embargo closely, but the group’s global affiliate structure and crypto laundering practices complicate direct takedown efforts.

>>> Read more: Coinbase Data Breach: $20M Bounty After Ransom Demand

Embargo ransomware’s blend of BlackCat’s proven tactics and a targeted focus on healthcare makes it one of today’s most dangerous cyber threats. Despite increased scrutiny by law enforcement, it was able to amass tens of millions in ransom payments within a year. It highlights the adaptability of bad actors and the ransomware-as-a-service model.

The healthcare sector and other high-risk industries are on notice! Ransomware gangs may change names, but their methods, infrastructure, and threat level often remain the same.