Embargo is developing and testing Rust-based tools and is able to disable security solutions present on the victim's system, adapting its tools to the specific environment of each attack
Researchers of ESET, a global European leader in the cybersecurity market, have identified new tools that lead to the installation of the Embargo group ransomware. This is a relatively new group in the ransomware field, it was in fact observed for the first time by ESET in June 2024. The new toolkit consists of a loader and a tool for deactivating endpoint detection and response (EDR) solutions, called MDeployer and MS4Killer respectively. The latter is particularly significant as it is tailored to each victim's environment, and targets specific security solutions. The malware uses Safe Mode and a vulnerable driver to disable security products on the victim's device. Both are written in Rust, the language chosen by the Embargo group for developing its ransomware.
Based on its modus operandi, Embargo appears to be a well-organized group with adequate resources. The group creates its own infrastructure to communicate with victims and uses double extortion as a method of pressure: in addition to encrypting data, operators exfiltrate sensitive information and threaten to publish it on a leak site. In an interview with a purported member of the group, an Embargo representative mentioned a basic payment scheme for affiliates, suggesting that the group offers a RaaS (ransomware as a service) service. “Given the sophistication of the group, the existence of a site for publishing leaks and the statements made, we hypothesize that Embargo actually operates as a RaaS provider,” says Jan Holman, an ESET researcher who analyzed the threat together with his colleague Tomáš Zvara.
Differences in distributed versions, bugs, and residual artifacts indicate that these tools are still in active development. Embargo is trying to establish itself as a leading ransomware operator.
Developing custom loaders and EDR removal tools is a common tactic used by several ransomware groups. Besides the fact that MDeployer and MS4Killer have always been detected together, there are further connections between them. The close correlation between these tools suggests that they are developed by the same threat actor, and the active development of the toolkit indicates that the group has a good command of the Rust language.
With MDeployer, Embargo uses Safe Mode to disable security solutions. MS4Killer is a typical defense evasion tool that terminates security product processes using the technique known as Bring Your Own Vulnerable Driver (BYOVD). In this technique, the attacker exploits vulnerable, signed kernel drivers to achieve kernel-level code execution. Ransomware affiliates often integrate BYOVD tools into their compromise process to alter the security solutions that protect the attacked infrastructure. Once security software is disabled, affiliates can execute the ransomware payload without worrying about detection.
The main purpose of the Embargo toolkit is to ensure successful ransomware installation by disabling the victim's infrastructure security solutions. The group dedicates a lot of effort to this aspect, replicating the same functionality in different phases of the attack. “We also observed the ability of attackers to adapt their tools in real time, during an active intrusion, to address a specific security solution,” adds Tomáš Zvara, researcher at ESET.
For a more detailed analysis and technical insight into Embargo tools, see the post “Embargo ransomware: Rock’n’Rust” on WeLiveSecurity.com. Follow ESET Research su Twitter (now known as X) for the latest news from ESET Research.
