Embargo’s Double Extortion Play Bags $34 Million From US Victims

Key Points

1. Embargo has collected more than $34 million in cryptocurrency from ransom payments since April 2024, targeting entities like American Associated Pharmacies and hospitals in Georgia and Idaho.

2. The group uses a double extortion method, first stealing data and then encrypting systems to demand ransom.

3. TRM Labs suggests Embargo could be linked to the now-defunct BlackCat (ALPHV) group, sharing code, leak sites, and wallet activity.

4. Approximately $18.8 million of Embargo's earnings remain in wallets not tied to any known service, with $13.5 million tracked moving through various virtual asset service providers.

5. Embargo employs multiple wallet addresses, high-risk exchanges, and sanctioned platforms for transferring funds.