Maze

Maze was a financially motivated ransomware operation active from 2019 through late 2020 that became widely known for pioneering large-scale double-extortion ransomware. In addition to encrypting victim systems, Maze operators and affiliates stole data and threatened public disclosure through a dedicated leak site, establishing a coercive model later adopted across the ransomware ecosystem. The operation is commonly referred to as Maze, Maze Team, Maze Crew, or Maze ransomware, and reporting has linked its later evolution and affiliate migration to Egregor and, in some accounts, Sekhmet. Maze functioned as an affiliate-driven crimeware operation rather than a single intrusion set. Affiliates used multiple initial-access vectors, including phishing and spearphishing, exposed RDP, brute force, and SMB exploitation, then relied heavily on commodity and red-team tooling for post-compromise activity. Observed tooling associated with Maze intrusions includes Cobalt Strike, PowerShell, Metasploit, AdFind, Koadic, Empire, GMER, and Mimikatz. Documented behaviors include reconnaissance, credential theft, privilege escalation, persistence through multiple backdoors, lateral movement via SMB, RDP, network shares, and PsExec, and process injection to conceal beacon activity. Maze components were also delivered through MSI packages executed with msiexec, and affiliates used a custom loader commonly called DllCrypt. Maze campaigns typically involved multi-stage intrusions in which ransomware deployment occurred after substantial hands-on-keyboard activity. Affiliates mapped networks, scanned internal and external targets, waited for privileged logons when necessary, and then encrypted systems while also exfiltrating sensitive data for extortion. The group publicly shamed non-paying victims by listing them on its leak site and publishing samples or larger portions of stolen data. Maze was also associated with threats to abuse stolen information in follow-on pressure campaigns. Reporting on backup-focused extortion tradecraft indicates Maze actors sought cloud and backup credentials, restored victim data to attacker-controlled infrastructure for theft, and deleted backups before encryption. Victimology shows broad targeting across private-sector and public-sector organizations, including IT services, legal services, medical and healthcare entities, insurance, staffing, transportation, manufacturing, distributors and resellers, and government-related organizations. Named victims and reporting indicate activity affecting organizations in the United States, Germany, Italy, Poland, France, Canada, and Japan. Maze was repeatedly described as one of the most dangerous and actively developed ransomware frameworks of its period. Maze’s influence extended beyond its own campaigns. It is widely credited as the first ransomware operation to normalize double extortion at scale, and later groups such as Egregor, REvil, Conti, and others adopted similar pressure tactics. Reporting also indicates overlap between Maze affiliates and other eCrime ecosystems, including TrickBot, Gozi, Zloader, and IcedID. Multiple reports state that many Maze affiliates shifted to Egregor after Maze announced its shutdown in late 2020, and some reporting has linked individuals associated with Maze leadership to Egregor as well.