Loading malware…
MDeployer is a Rust-based Windows loader used by the Embargo ransomware operation. It decrypts and deploys the Embargo ransomware payload and the MS4Killer security-product termination tool using RC4. A DLL variant establishes persistence by configuring a Windows service that launches after a reboot into Safe Mode; it can also create a scheduled task for persistence. In the Embargo attack chain, MDeployer supports defense evasion by facilitating Safe Mode execution, weakening endpoint defenses, deploying the BYOVD-enabled MS4Killer component, and ultimately launching ransomware. It can remove decrypted artifacts, terminate the security-killer component, and reboot the host following execution. Embargo has been linked to financially motivated, double-extortion ransomware attacks, including against healthcare, technology, manufacturing, and business-services organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MDeployer is part of Embargo's two-stage Rust toolkit: it decrypts b.cache to praxisbackup.exe (MS4Killer) and a.cache to pay.exe (the ransomware) using RC4.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Ransomware is distributed through a GPO scheduled task named SysUpdate; schtasks creates the task to run pay.exe as SYSTEM.
Ransomware is distributed through a GPO scheduled task named SysUpdate; schtasks creates the task to run pay.exe as SYSTEM.
Embargo has encrypted both MDeployer and MS4 Killer payloads with RC4.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rust-written loader used in Embargo intrusions to decrypt and launch payload components from .cache files, including the ransomware and MS4Killer. A DLL variant can force Safe Mode reboot, establish persistence, tamper with Defender Safe Mode registry entries, and then execute the ransomware.
Rust-based Embargo loader/deployer that decrypts and executes the ransomware and MS4Killer components. A DLL variant configures Safe Mode, establishes irnagentd persistence, tampers with Defender Safe Mode registry entries, disables security products, and executes the ransomware.
Loader/toolkit used to decrypt and launch payloads including MS4Killer and the Embargo ransomware executable, and to establish persistence via services and scheduled tasks, including Safe Mode execution.
Rust-based loader used in Embargo ransomware attacks to deploy/execute additional tooling or payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.