This month MOXFIVE responded to a new threat actor, Embargo Ransomware, targeting healthcare and manufacturing/supply chain organizations. While this group may be early in their eCrime lifecycle, we are proactively providing insights on targeted industries, CVEs, and recovery actions taken within the first 24 hours.

Please see the following for insights on Embargo. If interested, we’re glad to host a 1:1 session with your team to discuss the current ransomware landscape and provide guidance on best DFIR/recovery practices when responding to suspected cyber events.
‍
April 2024 Targeted Industries: Healthcare, Manufacturing/Supply Chain

• Victim employee size: 450 and 5500

Ransomware Payment Demands: Started at $2 million in BTC and eventually negotiated down to $500k in BTC, a 75% reduction.

Notable Leveraged Exploits: ‍

• CVE-2023-26360
• Adobe Security Bulletin

Embargo Ransomware is observed to have successfully disabled SentinelOne EDR agents via a malicious driver deployed through group policy objects (GPO) before leveraging a secondary GPO for the ransomware binary deployment/encryption.

• TA dwell time was ~5 weeks resulting in data exfiltration prior to encrypting 90%+ of the total server environment.
• (Like other actors) specifically targeting ESXi and virtualized parts of IT infrastructure.
• Encryption present at the file and disk level.

Data Exfiltration: Data exfiltration technique and deployment using MEGA synch.

• MegaSync[dot]exe should be proactively blocked in almost all environments.

MOXFIVE Recovery Actions Taken within First 24 Hours:

• Commenced active directory health check.
• Accessed backup solution to assess viability.
• Conducted global password reset of all user accounts.
• Collected logs and forensic evidence on behalf of DFIR provider.
• Rebuilt encrypted domain controllers, ESXi infrastructure, and other encrypted assets.

If you would like to know more or need assistance with incident response efforts, please contact us at 833-568-6695 or email our team at incident@moxfive.com.