Loading malware…
Maze is a human-operated Windows ransomware family first observed in 2019 and previously referred to as ChaCha ransomware because of its use of the ChaCha encryption algorithm. It became one of the most prominent early double-extortion operations by stealing victim data before file encryption and threatening public release of the stolen information if ransom demands were not met. Maze operators also maintained a victim negotiation portal with chat and test-decryption functionality and publicly exposed data from non-paying organizations, helping popularize leak-site-based extortion across the ransomware ecosystem.
Maze has been delivered through multiple intrusion paths, including spam email attachments, exploitation of vulnerabilities, and hands-on network intrusion. Reporting also associates Maze affiliate activity with exposed remote access services in some enterprise compromises. Operationally, Maze is commonly deployed late in an intrusion after attackers have already established access and conducted internal reconnaissance.
Technically, Maze has been documented as using a loader-and-payload architecture in which a loader decrypts and launches a main DLL module from an embedded resource. The malware employs layered decryption and anti-analysis measures, including anti-debugging checks and patching of DbgUiRemoteBreakin to interfere with debugger attachment. It also uses Windows API calls extensively during execution and encryption, can inject a malicious DLL into another process, and has been observed obscuring API invocation paths.
During execution, Maze enumerates running processes, terminates selected applications and analysis tools, deletes volume shadow copies to hinder recovery, and can encrypt files on local drives and network shares. It has also been observed querying antivirus information, collecting host details, and transmitting system information outward. Maze establishes persistence in some cases through scheduled tasks and startup-folder artifacts. Components used in Maze attacks have also been delivered via MSI packages executed with msiexec.
Maze targeted a broad range of organizations, including enterprises, law firms, insurers, healthcare and medical facilities, and managed environments. The operation is widely associated with an affiliate-based crimeware model and with later collaboration or overlap with other ransomware ecosystems, including leak-platform cooperation with other groups. Maze is considered defunct, but its double-extortion model and tradecraft significantly influenced subsequent ransomware operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Example actor leveraging Metasploit for SMB scanning: use auxiliary/scanner/smb/smb_ms17_010
CVE-2016-7255 Classification: 1-Day Basic Description: Memory corruption in NtUserSetWindowLongPtr Used by the following malware families: LockCrypt | CVE-2018-8453 ... Used by the following malware families: REvil (Sodinokibi), Maze, Neshta.
Initial Sample – CVE-2018-8453 ... Kaspersky detailing how Sodin (a.k.a Sodinokibi, or REvil), an infamous ransomware, is using a 1-Day exploit for CVE-2018-8453. | CVE-2018-8453 ... Used by the following malware families: REvil (Sodinokibi), Maze, Neshta.
The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability if it improperly handles symbolic links... The exploit was used in Maze and Egregor ransomware campaigns. | The exploit was used in Maze and Egregor ransomware campaigns.
The servers were vulnerable to the CVE-2019-19781 vulnerability, which Mursch described as "Maze's favorite vector of compromise." | The operators of the Maze ransomware have published today tens of GB of internal data from the networks of enterprise business giants LG and Xerox following two failed extortion attempts.
Maze Ransomware now uses the Spelevo exploit kit in a new malicious campaign using a Flash Player vulnerability to attack users. When redirected to Spelevo, the exploit kit will attempt to use vulnerability CVE-2018-15982. Vulnerable users are Flash Player versions 31.0.0.153 / 31.0.0.108 and earlier. After successful exploitation, the exploit kit automatically downloads and installs the Maze Ransomware payload. | Maze Ransomware Aliases: Maze Locker, MazeLocker, ChaCha, ChaChaLocker ... Этот крипто-вымогатель шифрует данные бизнес-пользователей и компаний с помощью RSA + ChaCha20 ... Вымогатели, распространяющие Maze, могут публиковать украденные данные с целью усиления давления на жертву.
A threat actor involved in the attack confirmed that they gained initial access to at least one compromised network via the CVE-2019-11510. Exploiting the CVE-2019-11510 A vulnerability in Pulse Secure VPN servers, tracked as CVE-2019-11510, is one of the most popular flaws exploited by ransomware gangs to deploy encrypting malware. | SK Hynix Maze attacked the South Korean memory and semiconductor manufacturer SK Hynix... While no details of the attack are known, exploitation of CVE-2019-11510 is among Maze’s TTPs.
"Since November 2019, we’ve seen the MAZE ransomware being used in attacks that combine targeted ransomware use, public exposure of victim data, and an affiliate model."
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"305419896": "Ryuk/TrickBot/Maze/EvilCorp/Pyxie/APT41 - Stats uniques -> ips/hostnames: 344 publickeys: 200"
Maze ransomware doesn’t just demand payment for a decryptor but exfiltrates victim data and threatens to leak it publicly if the target doesn’t pay up.
La campagne d’attaques délivrant Egregor serait liée à la fin d’activité du groupe d’attaquants à l’origine du rançongiciel Maze.
According to Callow, the security incident was a data-stealing ransomware attack launched by the Maze ransomware group. Maze not only spreads across a network, infecting and encrypting every computer in its path, it also exfiltrates the data to the attackers’ servers where it is held for ransom.
Egregor ransomware appeared in September 2020 and was the heir apparent to the infamous Maze ransomware group, which first emerged in May 2019.
In 2023, FIN7 expanded its operations to include the deployment of ransomware through affiliations with RaaS groups such as REvil and Maze, while also managing its own RaaS programs, including the now-retired Darkside and BlackMatter.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Mazeランサムウェアのメインモジュールはその後、 WMI クエリを使用してボリュームシャドウコピーを削除します。
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
This means it is leveraged post initial access phase, frequently reported to be through RDP[5,6].
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
リソースセクションの画像の後半部分からロードしたデータはまず XOR で復号されます。XORで復号された後のデータは Base64 文字列となっています。
Mazeランサムウェアの EXE ファイルには PNG 画像がリソースセクションに埋め込まれており、メインモジュール (DLL) はその画像の中に多重に暗号化され保存されています。
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Mazeランサムウェアのメインモジュールはその後、 WMI クエリを使用してボリュームシャドウコピーを削除します。これによってシステムの復元によるデータ復旧が行えなくなります。
This particular campaign includes a signed DLL payload (kepstl32.dll).
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).
Mazeランサムウェアには感染を停止させる「キルスイッチ」が2つ存在します。1つ目は、端末内に「 C:\JDUIHiuf\IDisjopjcnb 」というファイルが存在した場合、感染を行わずすぐに終了します。2つ目に用意されているのは、実行引数に「 --DIdsjdjdj 」という文字列が含まれていた場合で、こちらも同様に感染を行わずすぐに終了します。
NtSetEaFile という API を使用して見えないように上記のファイルの NTFS ファイルシステムの拡張ファイル属性( extended file attribute )という隠された領域に中に埋め込んでいます。
VirtualProtect を使用して ntdll の DbgUiRemoteBreakin という関数のアドレス帯のアクセス権を PAGE_EXECUTE_READ から PAGE_EXECUTE_READWRITE に変更し、開始アドレスの命令を 0x6C から 0xC3(ret 命令 ) へ 1 バイト書き換えます。
例えば、ユーザ名が「 Taro 」の場合、以下のようなセリフが合成音声により繰り返し再生されます。 Taro Alert! Taro Alert! Dear Taro Your files have been encrypted by Maze ransomware!
以下はプロセス検索を行う際に使用する CreateToolhelp32Snapshot の API を呼び出す際の処理を抜粋していますが、無駄なジャンプを重ね API コールが簡単に見えないようにしています。
上記の通信では、感染端末の環境に関わる情報(コンピュータ名や OS 情報、ネットワーク情報、先ほど取得したアンチウイルス製品情報)が送信されます。
Mazeランサムウェアには感染を停止させる「キルスイッチ」が2つ存在します。1つ目は、端末内に「 C:\JDUIHiuf\IDisjopjcnb 」というファイルが存在した場合、感染を行わずすぐに終了します。2つ目に用意されているのは、実行引数に「 --DIdsjdjdj 」という文字列が含まれていた場合で、こちらも同様に感染を行わずすぐに終了します。
As with previous variants of Maze, the trojan will attempt to inhibit recovery by deleting shadow copies via WMIC.exe ( wmic.exe shadowcopy delete )
The FBI, CISA, and MS-ISAC have received numerous reports of ransomware attacks against K-12 educational institutions. | malicious cyber actors target school computer systems, slowing access, and—in some instances—rendering the systems inaccessible for basic functions, including distance learning.
177 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another ransomware family that combines encryption with data extortion/publication pressure.
Ransomware first observed in May 2019 that encrypts files, drops ransom notes, deletes shadow copies to inhibit recovery, and exfiltrates victim data for double-extortion by threatening public leaks.
Ransomware family mentioned as targeting healthcare and medical facilities during the COVID period.
A ransomware family referenced as a collaborator and technical influence on Conti, including shared negotiations and access to a Maze build for reverse engineering and improvement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.