Loading malware…
Maui is a ransomware family associated with North Korean state-sponsored cyber operations, most consistently linked to Lazarus Group activity and particularly to the Andariel cluster. It has been used since at least 2021 in intrusions against healthcare and public health organizations, including hospitals, and has also appeared in broader DPRK-linked operations targeting critical sectors. Public attribution by U.S. and allied authorities characterizes Maui as part of North Korea’s blend of revenue generation and strategic cyber activity.
Maui is used as an extortion tool that encrypts victim data and disrupts operations. Its deployment has been observed in campaigns where operators first obtain access through exploitation of vulnerable internet-facing systems or other intrusion methods, then conduct hands-on-keyboard activity inside victim environments before launching ransomware. In DPRK-linked healthcare incidents, Maui activity has been associated with broader tradecraft including credential theft, reconnaissance, lateral movement, persistence, defense evasion, and data theft or staging prior to encryption. Reporting on Andariel and related Lazarus operations places Maui alongside other bespoke DPRK ransomware families such as H0lyGh0st and SHATTEREDGLASS.
Victimology most prominently includes healthcare and public health entities in the United States, though reporting also places Andariel-linked ransomware activity across South Korea, Japan, and other regions. Maui is notable because it reflects North Korea’s use of custom ransomware not only for financial gain but also within state-directed intrusion ecosystems that overlap with espionage-oriented access, long dwell times, and post-compromise operator control.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Recently observed CVEs that actors used to gain access include remote code execution in the Apache Log4j software library (known as Log4Shell)... Observed CVEs used include: CVE-2021-44228
Observed CVEs used include: ... CVE-2022-24990 ... The TerraMaster OS Unauthenticated Remote Command Execution via PHP Object Instantiation Vulnerability is characterized by scanning activity targeting a flaw...
Recently observed CVEs that actors used to gain access include ... remote code execution in unpatched SonicWall SMA 100 appliances... Observed CVEs used include: CVE-2021-20038
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While Kaspersky discovered the use of Dtrack and Maui, we've observed the use of VSingle, YamaBot and MagicRAT.
Lazarus Group has historically built its own ransomware -- WannaCry (2017), Maui (2022), H0lyGh0st (2022).
For more information on this ransomware activity, see... North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector.
North Korea has long been involved in ransomware attacks and has been previously associated with the Maui and Play ransomware families.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
"...remote code execution in unpatched SonicWall SMA 100 appliances [T1190 and T1133]."
"The other victim operated a vulnerable Weblogic server... compromised this server via the CVE-2017-10271 exploit." | "In one victim system, we discovered that a well-known simple HTTP server, HFS7, had deployed the malware above. After an unknown exploit was used on a vulnerable HFS server and “whoami” was executed..."
U.S. agencies have attributed Maui ransomware activity against healthcare organizations to North Korean state-sponsored actors. | DPRK-linked actors have targeted healthcare and other critical sectors, often using ransomware. U.S. agencies have attributed Maui ransomware activity against healthcare organizations to North Korean state-sponsored actors.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this malware family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.