Embargo ransomware group moved $34M in crypto since April: TRM Labs
A relatively new ransomware group known as Embargo has become a key player in the cybercrime underground, moving over $34 million in crypto-linked ransom payments since April 2024.
Operating under a ransomware-as-a-service (RaaS) model, Embargo has hit critical infrastructure across the United States, with targets including hospitals and pharmaceutical networks, according to blockchain intelligence firm TRM Labs.
Victims include American Associated Pharmacies, Georgia-based Memorial Hospital and Manor, and Weiser Memorial Hospital in Idaho. Ransom demands have reportedly reached up to $1.3 million.
TRM's investigation suggests Embargo may be a rebranded version of the infamous BlackCat (ALPHV) operation, which disappeared following a suspected exit scam earlier this year. The two groups share technical overlap, using the Rust programming language, operating similar data leak sites, and exhibiting onchain ties through shared wallet infrastructure.
Related: US DOJ seizes $24M in crypto from accused Qakbot malware developer
Embargo holds $18.8M in dormant crypto
Around $18.8 million of Embargo’s crypto proceeds remain dormant in unaffiliated wallets, a tactic experts believe may be designed to delay detection or exploit better laundering conditions in the future.
The group uses a network of intermediary wallets, high-risk exchanges, and sanctioned platforms, including Cryptex.net, to obscure the origin of funds. From May through August, TRM traced at least $13.5 million across various virtual asset service providers and more than $1 million routed through Cryptex alone.
While not as visibly aggressive as LockBit or Cl0p, Embargo has adopted double extortion tactics, encrypting systems and threatening to leak sensitive data if victims fail to pay. In some instances, the group has publicly named individuals or leaked data on its site to increase pressure.
Embargo primarily targets sectors where downtime is costly, including healthcare, business services, and manufacturing, and has shown a preference for US-based victims, likely due to their higher capacity to pay.
Related: Coinbase faces $400M bill after insider phishing attack
UK to ban ransomware payments for public sector
The UK is set to ban ransomware payments for all public sector bodies and critical national infrastructure operators, including energy, healthcare, and local councils. The proposal introduces a prevention regime requiring victims outside the ban to report intended ransom payments.
The plan also includes a mandatory reporting system, with victims required to submit an initial report to the government within 72 hours of an attack and a detailed follow-up within 28 days.
Ransomware saw a 35% drop in attacks last year, according to Chainalysis. It marked the first drop in ransomware revenues since 2022, according to the report.
Magazine: Inside a 30,000 phone bot farm stealing crypto airdrops from real users
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Nvidia earnings report and Anthropic trillion-dollar IPO coming in succession! The bigger test for AI trading is next week
The aftershocks of Jensen Huang's resignation have not subsided, and next week the AI sector faces a "double test": Nvidia's first financial report in the "post-Huang era"—if the performance falls short of expectations, the market's punishment will be intensified; Anthropic is launching its IPO with a trillion-dollar valuation. Two major uncertainties are looming, which will directly determine whether global capital's faith in AI can be sustained.
Goldman Sachs Global Stock Market Outlook: AI Capital Expenditure to Peak Next Year, Earnings Growth to "Slow Down Significantly", Cloud Giants Become "Defensive Assets"
Goldman Sachs’ 2027 Global Equity Strategy points out that the AI capital expenditure boom is nearing its peak, and global profit growth will slow significantly. S&P 500 earnings growth is expected to drop from 36% to 11%, with depreciation pressures gradually emerging. However, cloud giants’ valuations have adjusted to a forward P/E of 19.7, lower than the staples sector, and are classified as “relatively defensive” assets. Goldman Sachs predicts an S&P 500 target of 8,700 points and suggests overweighting the US and Japan, while underweighting Europe.
With $135 billion worth of Nvidia stock, will Jensen Huang cash out?
After Jensen Huang stepped down, his Nvidia holdings of approximately 812 million shares, valued at $135 billion, became a major pressure on the stock price. Any reduction in holdings is subject to both legal and market constraints: shares can only be sold compliantly after the disclosure of any undisclosed negative information, and the volume is equivalent to six trading days’ total market transactions, meaning large-scale cashouts would have to be spread over several months.
Will the traditional Christmas rally still happen in the US stock market this year?
After a simultaneous technical and position-based recovery in the US stock market, Goldman Sachs, Morgan Stanley, and JPMorgan have successively signaled a year-end rebound. Extremely light positions, mean reversion of valuations, and seasonal support together create conditions for a short squeeze. However, global manufacturing import price inflation has annualized at around 24%, surpassing the pandemic peak, and the inflation bill will come due intensively in the first quarter of next year. Goldman Sachs warns that once the year-end rally materializes, it may exhaust future upside potential.
Crypto prices
More
