Maze Ransomware

the attackers created a fake Abra cryptocurrency site to buy ad network traffic which was later used to redirect visitors to the exploit kit landing page under certain conditions.

Weak RDP credentials on machines accessible from the internet also pose a threat as the operators of Maze may use this flaw as well.

The distribution tactic of the Maze ransomware initially involved infections via exploit kits (namely, Fallout EK and Spelevo EK), as well as via spam with malicious attachments.

The servers were vulnerable to the CVE-2019-19781 vulnerability, which Mursch described as "Maze's favorite vector of compromise."

After the company refused to cough up the 300 Bitcoin ($2.3 million) ransom, the attackers threatened to use sensitive information extracted from Allied Universal’s systems, as well as stolen email and domain name certificates, for a spam campaign impersonating the company.

Below is an example of one of these malicious spam messages containing an MS Word document with a macro that’s intended to download the Maze ransomware payload.

Some incidents involved spear-phishing campaigns that installed Cobalt Strike RAT

Once the virtual machine was started... a batch file called startup_vrun.bat batch file would be executed that preps the machine with the Maze executables.

If they fall for it, the malicious macro contained inside the document will execute, which in turn will result in the victim’s PC being infected with Maze ransomware.

If the recipient opens the attached document, they will be prompted to enable editing mode and then enable the content. If they fall for it, the malicious macro contained inside the document will execute, which in turn will result in the victim’s PC being infected with Maze ransomware.

Weak RDP credentials on machines accessible from the internet also pose a threat as the operators of Maze may use this flaw as well.

Weak RDP credentials on machines accessible from the internet also pose a threat as the operators of Maze may use this flaw as well.

It employs various tricks to hinder static analysis, including dynamic API function imports, control flow obfuscation using conditional jumps, replacing RET with JMP dword ptr [esp-4], replacing CALL with PUSH + JMP, and several other techniques.

The Maze ransomware is typically distributed as a PE binary (EXE or DLL depending on the specific scenario) which is developed in C/C++ and obfuscated by a custom protector.

To counter dynamic analysis, this Trojan will also terminate processes typically used by researchers, e.g. procmon, procexp, ida, x32dbg, etc.

Weak RDP credentials on machines accessible from the internet also pose a threat as the operators of Maze may use this flaw as well.

In their third attack, Maze deployed an MSI file that installed the VirtualBox VM software on the server along with a customized Windows 7 virtual machine.

During these stages, the use of the following tools has been observed: mimikatz, procdump, Cobalt Strike, Advanced IP Scanner, Bloodhound, PowerSploit, and others.

During these stages, the use of the following tools has been observed: mimikatz, procdump, Cobalt Strike, Advanced IP Scanner, Bloodhound, PowerSploit, and others.

When executing on a machine, Maze ransomware will also attempt to determine what kind of PC it has infected. It tries to distinguish between different types of system (‘backup server’, ‘domain controller’, ‘standalone server’, etc.).

During these stages, the use of the following tools has been observed: mimikatz, procdump, Cobalt Strike, Advanced IP Scanner, Bloodhound, PowerSploit, and others.

Weak RDP credentials on machines accessible from the internet also pose a threat as the operators of Maze may use this flaw as well.

Cybercriminals are embracing data-theft extortion by creating dark web marketplaces that exist solely to sell stolen data.

Yesterday, the Maze actors released 2GB of the 32GB of files that they state they stole from the city before encrypting the network.

During these intermediate stages, the threat actors attempt to identify valuable data stored on the servers and workstations in the compromised network.

Before encrypting a victim's network, most network-targeting ransomware operations will steal a victim's unencrypted files.

The Maze ransomware is part of a new wave of particularly devious strains of ransomware which steal data before encrypting it and threatens to release this stolen data if the victim organisation does not pay.

Researchers said that Maze’s operators have since created a dedicated web page, which lists the identities of their non-cooperative victims and regularly publishes samples of the stolen data.

Before deploying ransomware, the Maze operators always steal unencrypted files before encrypting them. | Cognizant can confirm that a security incident involving our internal systems, and causing service disruptions for some of our clients, is the result of a Maze ransomware attack.

These files are then used as leverage by threatening to release them publicly on data leak sites if a ransom is not paid.