embargoMalware
Embargo is a ransomware variant written in Rust that has been active since at least May 2024. Embargo ransomware operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid.From MITRE ATT&CK
Last reported 2 days ago, by Tenable89 reports
ATT&CK techniques
6 of 195 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“…tivity maps to Exploit Public-Facing Application (T1190), and once an attacker has code execution, to Command and Scripting Interpreter (T1059) and Server Software Component: Web Shell (T1505.003).”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1059.003Windows Command Shell
“T1059.003”
- T1082System Information Discovery
“T1082”
- T1140Deobfuscate/Decode Files or Information
“T1140”
- T1036Masquerading
“T1036 – Masquerading: Rename Legitimate Utilities”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
89 reports · the newest 20, newest first · the exact sentence from each-
The adversary economy: How threat actors are reacting to PHP2Shell“Intelligence reporting indicates that exploit code for both CVEs circulated in private channels before the public embargo lifted, with pre-disclosure exploitation observed as early as Oct.”
-
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.””
-
Tech and Security Companies Respond to PHP2Shell Vulnerabilities“Amazon says the first exploitation attempt came on October 17, before the embargo lifted.”
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure“"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Amazon said.”
-
PHP2Shell Exploitation Started Days Before Patches“According to Amazon, the first PHP2Shell exploitation occurred on October 17, while the security defects were still under embargo, and originated from a commercial anonymization network.”
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed“"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure."”
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk“…ard under the bus: “On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.”
-
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches“PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches”
-
¿Es una estafa? Cómo identificar un anuncio fraudulento antes de hacer clic“Sin embargo, quizá el mayor riesgo provenga de las redes sociales.”
-
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)“The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted.”
-
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities“The security firm watchTowr said Tuesday the vulnerabilities had been set for release Thursday under embargo.”
-
PHP2Shell: CVE-2026-109618 & CVE-2026-109619“watchTowr then confirmed on X that the flaws were real and under embargo, and urged users to apply patches once available.”
-
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities“According to watchTowr, the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo.”
-
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert“watchTowr then posted on X that the leaked information was real, that the two flaws were under embargo, that everyone had been supposed to wait until Thursday, and that it could not share more for now.”
-
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)“The team scheduled that release for Wednesday, October 21 at 14:00 UTC, a day earlier than the original embargo, and noted it reserves the right to release even sooner "should details of either vulnerability become public, or should evidence of active exploitation appear in the w…”
-
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619“Information leaked on October 20 ahead of the embargo, which is why PHP moved its release forward to October 21 at 14:00 UTC.”
-
Qué hacer cuando una empresa informa una brecha de datos, pero aporta poca información“Sin embargo, apenas una cuarta parte (24%) incluía detalles sobre el vector de ataque.”
-
Cómo opera una estafa de inversión que utiliza medios falsos, figuras públicas y la identidad de una empresa financiera real“Sin embargo, el engaño no termina en esa página.”
-
Cómo los estafadores se aprovechan de los propietarios de tiempos compartidos“Sin embargo, muchos consumidores siguen invirtiendo en ellos.”
-
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)“June 1, 2026: Zimbra requested an embargo on publication until the planned ZCS 10.1.18 release in September.”
Indicators in its reports
named in the reports above- calif[.]ioin 2 reports
- 103.216.220[.]92in 2 reports
- 31.223.184[.]166in 2 reports
- 37.19.200[.]5in 2 reports
- 134.209.159[.]64in 2 reports
- 103.114.163[.]188in 2 reports
- 95.217.98[.]37in 2 reports
- key.accountby[.]namein 1 report
- key.accountby[.]idin 1 report
- 8.58.5[.]11in 1 report
- 8.48.4[.]26in 1 report
- 8.38.3[.]35in 1 report
- 8.28.2[.]34in 1 report
- 31c0ea7d7ff1d1fc…544011628065in 1 report
- linux.advanced[.]eventsin 1 report
- 85.11.167[.]243in 1 report
- 45.198.224[.]169in 1 report
- 109.71.252[.]97in 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.