Maze

Malware updated a month ago (2024-10-15T10:01:36.030Z)

Download STIX

Preview STIX

Maze is a form of malicious software, or malware, that pioneered a novel double-extortion tactic in the cyber threat landscape. Its modus operandi involves stealing victims' files before encrypting them, thereby enabling the threat actors to threaten both the disruption of operations and the release of sensitive data. This dual-threat approach was first observed in 2019 when Maze ransomware targeted Allied Universal, a security and facility services company. The attackers demanded a ransom of $3.8 million; however, when Allied refused to pay, Maze retaliated by leaking all their stolen data. The Maze group further demonstrated their control over Allied's data by releasing 700MB of it via a link on a Russian forum. This incident marked the first reported double-extortion attack, according to FraudWatch. In response to these threats, cybersecurity firms have developed tools to combat Maze ransomware. For instance, Emsisoft offers a decryption tool specifically designed to counteract the Maze ransomware strain. The emergence of Maze has added a new layer of complexity to the cybersecurity landscape, forcing businesses and organizations to navigate an intricate web of digital threats. Despite the efforts to mitigate its impact, Maze continues to pose significant risks. Notably, a payment of $22 million reportedly made its way through the bitcoin maze to the AlphV wallet on the 1st. As the cybersecurity field grapples with these evolving challenges, experts like Dr. Marios are contributing to the discourse with works such as his forthcoming book, "Falkon’s Maze on Cyber-Security".

Description last updated: 2024-10-15T09:20:55.976Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Maze Ransomware is a possible alias for Maze. Maze ransomware is a type of malware that emerged in 2019, employing a double extortion tactic to wreak havoc on its victims. This malicious software infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for	4
REvil is a possible alias for Maze. REvil, also known as Sodinokibi, is a malicious software (malware) that operates on a Ransomware as a Service (RaaS) model. This model became increasingly popular in 2020, with first-stage malware like Dridex and Gootkit being linked to ransomware attacks such as BitPaymer and REvil respectively. Th	3
Sodinokibi is a possible alias for Maze. Sodinokibi, also known as REvil, is a highly active and impactful threat actor first identified in April 2019. Operating as a ransomware-as-a-service (RaaS), this group has been responsible for a significant proportion of global ransomware incidents. In 2020, Sodinokibi ransomware attacks accounted	3

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Malware

Ransom

Extortion

Vulnerability

Cybercrime

Encryption

RaaS

Espionage

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Ryuk Malware is associated with Maze. Ryuk is a type of malware known as ransomware, which has been utilized by the threat group ITG23 for several years. This group has been notorious for crypting their malware, with crypters seen in use with other malware such as Trickbot, Emotet, Cobalt Strike, and Ryuk. In 2019, most ransomware inves	Unspecified	4
The Clop Malware is associated with Maze. Clop, a malicious software (malware), is linked to a Russian-speaking cybercriminal group also known as Cl0p. It is designed to exploit and damage computer systems by stealing personal information, disrupting operations, or holding data hostage for ransom. In May 2023, the Clop group began exploitin	Unspecified	3
The Conti Malware is associated with Maze. Conti is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. Often spreading through suspicious downloads, emails, or websites, it can steal personal information, disrupt operations, or hold data hostage for ransom. Notably, Conti was linked to several ra	Unspecified	3
The Ragnar Locker Malware is associated with Maze. Ragnar Locker is a type of malware, specifically ransomware, known for its destructive impact on computer systems. It infiltrates systems primarily through suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or hold data hostage for rans	Unspecified	2
The Agent.btz Malware is associated with Maze. Agent.btz, also known as ComRAT v4, is a remote access trojan (RAT) developed using C++ and employing a virtual FAT16 file system. This malicious software was one of the earliest backdoors used by Pensive Ursa, a cyber-espionage group. Notably, the malware is frequently used to exfiltrate sensitive	Unspecified	2
The Netwalker Malware is associated with Maze. NetWalker is a highly profitable ransomware kit, known for its ability to disable antivirus software on Windows 10 systems and encrypt files, adding a random extension to the encrypted ones. Once executed, it disrupts operations and can even hold data hostage for ransom. It has been observed that Ne	Unspecified	2
The Lockbit Malware is associated with Maze. LockBit is a malicious software, or malware, known for its damaging and exploitative functions. It infiltrates systems via dubious downloads, emails, or websites, often without the user's knowledge, and can steal personal information, disrupt operations, or hold data hostage for ransom. The LockBit	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The DarkSide Threat Actor is associated with Maze. DarkSide is a threat actor known for its malicious activities, primarily in the realm of ransomware attacks. One of their most notable exploits occurred on May 7, 2021, when they targeted Colonial Pipeline Co., a major player in the U.S. energy sector. The attack disrupted the gasoline supply across	Unspecified	5
The Turla Threat Actor is associated with Maze. Turla, a threat actor linked to Russia, is known for its sophisticated cyber espionage operations. The group has been associated with numerous high-profile attacks, often utilizing advanced backdoors and fileless malware for infiltration and persistence. Turla's tactics, techniques, and procedures (	Unspecified	3
The Alphv Threat Actor is associated with Maze. Alphv, also known as BlackCat, is a notable threat actor in the cybersecurity landscape. Originating from Russia, this cybercriminal group has been involved in multiple high-profile ransomware attacks, specifically targeting healthcare providers. They gained significant attention after stealing 5TB	Unspecified	2
The Blackmatter Threat Actor is associated with Maze. BlackMatter, a threat actor in the cybersecurity realm, is known for its malicious activities and has been linked to several ransomware strains. The group emerged as a successor to the DarkSide ransomware, which was responsible for the high-profile attack on the Colonial Pipeline in May 2021. Howeve	Unspecified	2
The FIN7 Threat Actor is associated with Maze. FIN7, also known as Carbanak, Carbon Spider, Cobalt Group, and Navigator Group, is a notorious cybercrime group that has been active since 2012. The group is recognized for its advanced combination of malware and social engineering tactics, having executed numerous successful attacks against global	Unspecified	2
The Sangria Tempest Threat Actor is associated with Maze. Sangria Tempest, also known as Carbon Spider, Elbrus, and FIN7, is a threat actor that has been active since 2013. In mid-November 2023, Microsoft observed Sangria Tempest using Storm-1113's EugenLoader delivered through malicious MSIX package installations. The group frequently targets the restaura	Unspecified	2

Source Document References

Information about the Maze Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	a year ago	THE OUTLOOK Il master della CQURE Academy per muoversi nel labirinto della cyber security Condividi il post Condividi
InfoSecurity-magazine	6 months ago	NIST Confusion Continues as Cyber Pros Complain CVE Uploads Stopped
InfoSecurity-magazine	6 months ago	#RSAC: CISA Launches Vulnrichment Program to Address NVD Challenges
CERT-EU	8 months ago	The Evolution of Ransomware Tactics and Defense \| #ransomware \| #cybercrime \| National Cyber Security Consulting
CERT-EU	8 months ago	Navigating the Labyrinth of Digital Cyberthreats Using AI-Powered Cryptographic Agility
CERT-EU	8 months ago	Security Week 2024 wrap up – GIXtools
CERT-EU	8 months ago	Phobos Unleashed: Navigating the Maze of Ransomware’s Ever-Evolving Threat
CERT-EU	8 months ago	Phobos Unleashed: Navigating the Maze of Ransomware’s Ever-Evolving Threat
CERT-EU	8 months ago	NATO: Time to Adopt a Pre-emptive Approach to Cyber Security in New Age Security Architecture \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	8 months ago	This Week In Security: Blame The Feds, Emergency Patches, And The DMA
CERT-EU	8 months ago	Reach Security Raises $20M to Help Manage Cybersecurity Products
CERT-EU	9 months ago	Russia Announces Arrest of Medibank Hacker Tied to REvil \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker \| National Cyber Security Consulting
CERT-EU	9 months ago	Operation Cronos: Who Are the LockBit Admins
BankInfoSecurity	9 months ago	Russia Announces Arrest of Medibank Hacker Tied to REvil
BankInfoSecurity	9 months ago	Navigating the AI Career Maze
Unit42	10 months ago	Ransomware Retrospective 2024: Unit 42 Leak Site Analysis
CERT-EU	10 months ago	Detecting iOS malware via Shutdown.log file
CERT-EU	10 months ago	Autonomous Integrations: A New Perspective on Seamless Connectivity
CERT-EU	10 months ago	2024 Regulatory, Compliance, and Enforcement Predictions for Life Sciences Companies
CERT-EU	10 months ago	Examples of Past and Current Attacks \| #ransomware \| #cybercrime \| National Cyber Security Consulting