Loading story…
Embargo, also tracked as Storm-0501 and G1053, is conducting double-extortion ransomware operations against organizations in technology, healthcare, manufacturing, and other sectors. The group steals data—frequently using Rclone to MEGA—before encrypting systems with ChaCha20 and Curve25519. Researchers assess it as a probable BlackCat/ALPHV successor or rebrand based on Rust-based tooling, leak-site similarities, timing, and reported cryptocurrency-wallet overlap, though direct organizational continuity remains unconfirmed. Its intrusion activity includes exploiting internet-facing vulnerabilities, purchasing or abusing credentials, compromising Active Directory, and using bring-your-own-vulnerable-driver techniques to terminate security products.
Microsoft reported that Storm-0501 has expanded beyond on-premises encryption into cloud-focused extortion by pivoting from Active Directory into Microsoft Entra ID and Azure. In one enterprise intrusion, the actor abused an Entra Connect Sync server and an MFA-less synchronized Global Administrator account, established federation-based persistence with AADInternals, exposed Azure Storage, and exfiltrated data with AzCopy. The group then sought to destroy cloud storage and backups by removing locks and immutability controls; where deletion was prevented, it used customer-managed keys and encryption scopes to render blobs inaccessible and attempted to delete the associated keys. Embargo also uses MDeployer and MS4Killer for persistence and defense evasion, including Safe Mode services, scheduled tasks, registry changes, and the vulnerable probmon.sys driver before disabling recovery and encrypting victims’ files.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Lagoon Amusement Park in the United States was identified as Embargo's most recent named leak-site victim. The operation had listed 38 named victims by this point.
Microsoft reported that Storm-0501 had extended its on-premises ransomware activity into hybrid-cloud environments, compromising Active Directory and pivoting into Microsoft Entra ID to gain Global Administrator privileges.
Embargo's first reported victim appeared on its leak site, marking the operation's first known public victim listing.
The Embargo ransomware-as-a-service operation, also tracked as Storm-0501 and G1053, was first observed.
BlackCat/ALPHV reportedly conducted an exit scam. Embargo later emerged as a suspected, though unconfirmed, successor or rebrand sharing tooling and infrastructure characteristics.
Storm-0501 used Embargo ransomware in its attacks during 2024.
Storm-0501 targeted organizations in the healthcare sector.
Storm-0501 deployed Sabbath ransomware in attacks targeting school districts in the United States.
In a recent campaign against a large enterprise, Storm-0501 pivoted from Active Directory into Entra ID and Azure, established a malicious federated-domain backdoor, exfiltrated Azure Storage data, and attempted to delete or encrypt cloud resources and backups before extorting the victim through Microsoft Teams.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourceattack.mitre.org
Open sourcemicrosoft.com
Open sourcetrmlabs.com
Open sourcewelivesecurity.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said threat actor **Storm-1175** is running high-tempo intrusions that exploit newly disclosed and, in some cases, previously unknown vulnerabilities in internet-facing systems to steal data and deploy **Medusa ransomware** within days or even 24 hours. The financially motivated group has heavily impacted healthcare organizations and also targeted education, professional services, and finance in Australia, the United Kingdom, and the United States. Since 2023, the actor has exploited more than 16 flaws across products including **Microsoft Exchange**, **PaperCut**, **Ivanti**, **ConnectWise ScreenConnect**, **JetBrains TeamCity**, **SimpleHelp**, **CrushFTP**, **GoAnywhere MFT**, **SmarterMail**, **SAP NetWeaver**, and **BeyondTrust**, with Microsoft also observing zero-day use against SmarterMail and GoAnywhere before public disclosure. After gaining access, Storm-1175 establishes persistence with new administrator accounts, web shells, and remote management tools, then moves laterally using LOLBins, **Impacket**, **PDQ Deployer**, and Cloudflare tunnels while stealing credentials from **LSASS**, `NTDS.dit`, `SAM`, and backup systems. Microsoft said the actor tampers with Microsoft Defender settings to reduce detection, uses **Bandizip** and **Rclone** for collection and exfiltration, and deploys Medusa through PDQ Deployer or Group Policy; the group has also shown interest in Linux targets such as vulnerable **Oracle WebLogic** servers. Microsoft urged organizations to reduce exposure of web-facing assets, patch quickly, enforce MFA on approved RMM tools, restrict local administrator rights, and enable protections such as **Credential Guard**, tamper protection, and Defender XDR attack disruption features.
Aug 18, 2026
The **Egregor** ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with **Sekhmet** and possible former **Maze** affiliates, with additional reported ties to **ProLock** and **LockBit**. Victims cited in reporting included **GEFCO**, **Barnes & Noble**, and **Ubisoft**, while the group’s leak site reportedly listed **152 victim companies** across industries including information technology, construction, retail, consumer goods, and automotive. Intrusions commonly began with **phishing** or **RDP exploitation**, after which attackers used **Cobalt Strike** for payload delivery and in some cases leveraged **QBot** and living-off-the-land tools such as `bitsadmin`. The malware used heavily obfuscated DLL payloads with **Salsa20**-encrypted configuration data, required a sample-specific launch key passed with the `-p` parameter, and encrypted files with **ChaCha** and **RSA-2048**. Researchers also observed the group using **Rclone** with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Jul 12, 2026
Microsoft said the financially motivated, China-linked threat actor **Storm-1175** is using `CVE-2026-18577`, a critical authentication-bypass flaw in **N-able N-central**, to deploy a new ransomware strain called **StormEncryptor**. The activity began around July 31, with Microsoft observing ransomware deployments from August 2, the same day the vulnerability was publicly disclosed. The flaw can give unauthenticated attackers full administrative control of N-central servers, raising supply-chain concerns because managed service providers use the platform to manage large numbers of downstream customer endpoints. The campaign marks Storm-1175’s first observed activity since April and a shift from its earlier association with **Medusa** to a custom C++ encryptor. Microsoft observed the group using **AnyDesk**, **SimpleHelp**, **Advanced IP Scanner**, and **Mimikatz** for remote access, network discovery, credential theft, and hands-on-keyboard deployment. StormEncryptor appends the `.encrypted` extension to files and drops ransom notes named `!!!README_FIRST!!!.txt`. N-able released multiple emergency fixes after attackers bypassed an initial patch, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and Huntress warned that many internet-exposed N-central instances remained unpatched.
Aug 13, 2026