Wu said that TRM Labs reported that the Embargo ransomware group has extorted over $34.2 million since April 2024, primarily targeting the U.S. healthcare and manufacturing sectors. Its technical characteristics are highly similar to the now-defunct BlackCat, suspected to be a continuation version. Some of the ransom flows into the sanctioned platform Cryptex.net, with approximately $18.8 million still unaccounted for.