HackerFeeds
All ransomware groups

maze

59 tracked victims
·first seen 2019-10-21·last activity 2020-09-11

Activity analysis

HackerFeeds has tracked 59 victims claimed by maze since October 2019, most recently in September 2020 — ranking #95 of 332 groups (0.2% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in September 2020. Its most-targeted sector is Manufacturing (14 victims), followed by Technology (9). The United States accounts for 39 victims (71% of those with a known location); 4 victims did not disclose a location.

Victims per year

  • 20198
  • 202051

Top sectors

  • Manufacturing14
  • Technology9
  • Financial Services7
  • Healthcare5
  • Transportation/Logistics4
  • Public Sector4

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Maze ransomware group is one of the most known ransomware gangs, they targeted organizations worldwide across many industries. Security researchers believed that Maze operates as an affiliated network model. MAZE was one of the first groups that made a 'Double Extortion Attack' involved Allied Universal, in November 2019, the group leaks their victim's data in the darknet. On November 1, 2020, MAZE announced an official press release that they are closing their operation. is malware targeting organizations worldwide across many industries. Security researchers claim that the threat actor behind the MAZE group is 'TA2101'.

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1189Drive-by Compromise

    Maze distributed via exploit kits (Fallout EK, Spelevo EK) through malvertising campaigns and compromised websites.

  • T1190Exploit Public-Facing Application

    Exploitation of Pulse Secure VPN and Citrix ADC (CVE-2019-19781) vulnerabilities to gain initial access.

  • T1566.001Phishing: Spearphishing Attachment

    Maze used malicious Word documents with macros delivered via phishing emails as a primary initial access vector.

TA0002

Execution

  • T1059.001Command and Scripting Interpreter: PowerShell

    PowerShell used for payload delivery, lateral movement, and post-exploitation tasks.

  • T1203Exploitation for Client Execution

    Browser and plugin vulnerabilities exploited via exploit kits to execute the Maze payload on victim endpoints.

TA0005

Defense Evasion

  • T1218.011Signed Binary Proxy Execution: Rundll32

    Rundll32 used to load malicious DLLs and bypass application control solutions.

  • T1562.001Disable or Modify Tools

    Security software terminated and disabled using batch scripts prior to ransomware deployment.

TA0006

Credential Access

  • T1003.001OS Credential Dumping: LSASS Memory

    Mimikatz deployed to harvest credentials from LSASS memory.

TA0007

Discovery

  • T1018Remote System Discovery

    Active Directory enumeration to identify all hosts within the domain for maximum encryption coverage.

  • T1046Network Service Discovery

    Network scanning to enumerate hosts and services for lateral movement.

TA0008

Lateral Movement

  • T1021.001Remote Services: Remote Desktop Protocol

    RDP used for lateral movement across the network with harvested credentials.

  • T1021.002Remote Services: SMB/Windows Admin Shares

    PsExec and SMB shares used to propagate the Maze payload to remote systems.

TA0010

Exfiltration

  • T1567Exfiltration Over Web Service

    Maze pioneered the double extortion model — among the first ransomware groups to exfiltrate data before encryption and publish it on a dedicated leak site ('Maze News') to pressure victims into paying.

TA0011

Command and Control

  • T1071.001Application Layer Protocol: Web Protocols

    Cobalt Strike used for C2 communications over HTTPS.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Maze uses ChaCha20 for file encryption with RSA-2048 for key protection. Active 2019-2020, Maze was the pioneer of the double extortion model that became the ransomware industry standard. The group formally announced retirement in November 2020; affiliates migrated to Egregor.

  • T1490Inhibit System Recovery

    Volume Shadow Copies removed; Windows Backup catalog deleted to prevent recovery.

Recent victims

No victims tracked yet.