maze

T1189Drive-by Compromise

Maze distributed via exploit kits (Fallout EK, Spelevo EK) through malvertising campaigns and compromised websites.

T1190Exploit Public-Facing Application

Exploitation of Pulse Secure VPN and Citrix ADC (CVE-2019-19781) vulnerabilities to gain initial access.

T1566.001Phishing: Spearphishing Attachment

Maze used malicious Word documents with macros delivered via phishing emails as a primary initial access vector.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell used for payload delivery, lateral movement, and post-exploitation tasks.

T1203Exploitation for Client Execution

Browser and plugin vulnerabilities exploited via exploit kits to execute the Maze payload on victim endpoints.

T1218.011Signed Binary Proxy Execution: Rundll32

Rundll32 used to load malicious DLLs and bypass application control solutions.

T1562.001Disable or Modify Tools

Security software terminated and disabled using batch scripts prior to ransomware deployment.

T1003.001OS Credential Dumping: LSASS Memory

Mimikatz deployed to harvest credentials from LSASS memory.

T1018Remote System Discovery

Active Directory enumeration to identify all hosts within the domain for maximum encryption coverage.

T1046Network Service Discovery

Network scanning to enumerate hosts and services for lateral movement.

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement across the network with harvested credentials.

T1021.002Remote Services: SMB/Windows Admin Shares

PsExec and SMB shares used to propagate the Maze payload to remote systems.

T1567Exfiltration Over Web Service

Maze pioneered the double extortion model — among the first ransomware groups to exfiltrate data before encryption and publish it on a dedicated leak site ('Maze News') to pressure victims into paying.

T1071.001Application Layer Protocol: Web Protocols

Cobalt Strike used for C2 communications over HTTPS.

T1486Data Encrypted for Impact

Maze uses ChaCha20 for file encryption with RSA-2048 for key protection. Active 2019-2020, Maze was the pioneer of the double extortion model that became the ransomware industry standard. The group formally announced retirement in November 2020; affiliates migrated to Egregor.

T1490Inhibit System Recovery

Volume Shadow Copies removed; Windows Backup catalog deleted to prevent recovery.