U.K. Software Firm Insider Technologies Hit by Embargo Ransomware Attack

A recent cyberattack by the Embargo ransomware group has impacted Insider Technologies Limited, a Manchester-based software development company specializing in enterprise monitoring and data management solutions.

The breach, disclosed via the group’s dark web leak site on March 9, 2025, highlights the growing sophistication of ransomware tactics and their impact on critical IT infrastructure.

Technical Overview of the Attack

Embargo’s operation leverages a Rust-based toolkit designed to bypass security defenses.

The attack chain begins with MDeployer, a loader that decrypts and executes two payloads: MS4Killer (an endpoint detection and response disabler) and the ransomware itself.

MS4Killer, custom-compiled for each victim, selectively targets security solutions by abusing Safe Mode and vulnerable drivers to disable protections.

Once defenses are neutralized, the ransomware payload encrypts files, appending a random six-character extension (e.g., .b58eeb), and drops a ransom note (HOW_TO_RECOVER_FILES.txt).

The group employs double extortion, exfiltrating sensitive data before encryption and threatening to publish it on their leak site unless payment is made.

Insider Technologies’ systems, which include monitoring and alerting platforms used by financial and government clients, may now face operational disruptions and reputational risks.

Embargo’s Growing Threat Profile

First observed in June 2024, Embargo operates as a ransomware-as-a-service (RaaS) provider, offering affiliates tailored tools and infrastructure.

Their Rust-based tooling reflects a shift toward evasion-focused malware, mirroring tactics seen in BlackCat and Hive ransomware campaigns.

ESET researchers note the group’s ability to adjust tools mid-attack, enabling dynamic evasion of specific security products.

Impact on Insider Technologies

Insider Technologies, founded in 1989 and acquired by ETI-NET in 2015, provides data monitoring solutions to sectors including banking and intelligence agencies.

With an estimated £1.2 million turnover in 2023 and 11 employees, the breach could disrupt client services reliant on its platforms for real-time data integrity and SLA compliance.

The company’s infrastructure, hosted at insidertech.co.uk, has not yet released an official statement regarding the attack or potential data exposure.

Broader Implications

This incident follows Embargo’s recent targeting of healthcare providers, such as Georgia-based Memorial Hospital and Manor, where 1.15 TB of data was exfiltrated.

The group’s focus on customized attacks against mid-sized organizations underscores the need for enhanced endpoint detection and driver vulnerability management.

Mitigation Recommendations

• Audit and patch vulnerable drivers abused by tools like MS4Killer.
• Implement network segmentation to limit lateral movement post-breach.
• Monitor for anomalous Safe Mode activations or Rust-based processes.

As of March 10, 2025, Embargo’s leak site countdown indicates impending data publication, raising the urgency for Insider Technologies to address the breach.

The incident reinforces the critical role of proactive threat-hunting and adaptive defense strategies in countering RaaS ecosystems.

Also Read:

“Wish Stealer” Malware Uncovered: Major Security Threat Revealed!

See more