Loading story…
India’s Cyber Swachhta Kendra issued an alert on Maze ransomware, following McAfee Labs’ publication on the threat. Maze became known for double extortion: attackers stole sensitive information before encrypting victims’ files, then threatened to publish the stolen data to pressure organizations into paying. This approach made ransomware incidents both operational disruptions and potential data breaches.
Organizations defending against Maze should prioritize tested, isolated backups, timely patching, strong authentication for remote access, and monitoring for unauthorized data transfers and mass file changes. Incident-response plans should address data exposure alongside system recovery: restoring encrypted systems does not resolve the risk from stolen information. Suspected infections warrant rapid isolation of affected systems, preservation of evidence, and assessment of any notification obligations.
TTPs, infrastructure, and targeting history in one profile.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Maze ransomware operation escalated from file encryption to **double extortion**, stealing data from victims and threatening public leaks unless ransom demands were paid. Sophos reported that the group spent roughly a year refining this model, using intrusions against enterprise networks to maximize pressure on organizations already facing operational disruption from ransomware. The campaign helped normalize a tactic that later spread widely across the ransomware ecosystem: combining encryption with data theft and public shaming to force payment. Maze’s activity showed how ransomware groups were evolving into full-scale extortion operations, increasing legal, financial, and reputational risk for affected companies beyond the immediate impact of locked systems.
Jul 12, 2026
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026
Maze emerged as one of the most influential ransomware operations targeting businesses, corporations, and municipal organizations, combining file encryption with **data theft and public leak threats** to force victims into paying. The group first spread through exploit kits and malicious spam, then shifted to more targeted intrusions using spear-phishing, exploitation of internet-facing services such as **Citrix ADC/NetScaler** and **Pulse Secure VPN**, and attacks against weak **RDP** credentials. Researchers described Maze as a C/C++ Windows PE malware with obfuscation, anti-analysis features, and a layered encryption scheme that paired **ChaCha** with **RSA-2048**. The operation also expanded its influence by forming a ransomware cartel with **LockBit** and **RagnarLocker**, sharing leak infrastructure and tradecraft in a model that helped normalize double-extortion tactics across the broader ransomware ecosystem.
Aug 15, 2026