Loading malware…
Maze is a ransomware family and ransomware-as-a-service operation first branded as Maze in May 2019 and previously referred to as “ChaCha ransomware.” It became one of the earliest and most prominent double-extortion ransomware operations, stealing victim data and threatening public disclosure if ransom demands were not met. Public reporting in the provided content states that leak-based extortion ransomware tactics were pioneered around November 2019 by Maze. Maze operated victim negotiation infrastructure and a separate public leak/news site on Tor and the public Internet, used DECRYPT-FILES.txt as its ransom note, and in some cases dropped 000.bmp as wallpaper and played a synthesized voice alert via the Microsoft Speech API.
Maze has been delivered through multiple vectors including exploit kits, spam/phishing emails, Remote Desktop Protocol attacks, and other network exploitation methods. One documented infection chain used malicious Microsoft Word attachments that required users to enable macros; the macro then launched PowerShell to download and install the Maze payload. Proofpoint-linked TA2101 campaigns in October-November 2019 impersonated German and Italian tax authorities and delivered Maze through Word documents and PowerShell downloaders. Initial Maze samples were also associated with fake websites loaded with exploit kits.
Technically, Maze is described as mostly written in C++ with heavy assembly use and control-flow obfuscation. It dynamically resolved APIs by hashing names and matching exports before using LoadLibrary and GetProcAddress. It included anti-analysis and evasion features such as IsDebuggerPresent checks, PEB.BeingDebuggedFlag checks, process-name detection for tools including procmon, x32dbg, x64dbg, ollydbg, and procexp, and disabling of dynamic analysis and security tools including IDA debugger, x32dbg, and OllyDbg. The content also states that Maze disabled Windows Defender Real-Time Monitoring and attempted to disable endpoint protection services.
Maze performed selective execution checks by calling GetUserDefaultUILanguage and terminating if the system language matched a predefined exclusion list. It established persistence through a Windows autorun registry entry and also created scheduled tasks using names such as “Windows Update Security” to launch at a specific time. For reconnaissance and defense evasion, Maze queried antivirus products through WMI root\SecurityCenter2, used WMI to connect a virtual machine to the victim organization’s network domain, and communicated with hard-coded IP addresses over HTTP, including HTTP POST exfiltration over port 80 using WS2_32.dll. FireEye reporting cited in the content states that the Maze group also used RDP over the Ngrok service as an alternative command-and-control channel.
Maze attempted to impair recovery by deleting shadow volumes, including once before and once after encryption. The content specifically notes use of WMIC.exe and WMI for shadow copy deletion, and use of Wow64RevertWow64FsRedirection after deletion attempts to restore filesystem redirection state. For encryption, Maze used RSA and ChaCha20, skipped specific directories and file types, and dropped DECRYPT-FILES.txt ransom notes.
Maze is associated in the content with financially motivated extortion activity and broad enterprise targeting, with explicit references to attacks affecting healthcare during the COVID-19 period. Reported victims in the provided material include Allied Universal, Canon, Southwire, the City of Pensacola, LG Electronics, Xerox, and healthcare organizations. Canon reporting in the content states Maze claimed to have stolen 10 TB of data before deploying encryption. The content also notes that Maze announced in March 2020 that it would stop attacks on medical organizations until the COVID-19 situation stabilized, and that it withdrew pressure in at least one case involving the City of Pensacola.
The provided content also links Maze to the broader ransomware ecosystem. Multiple intelligence and security companies believed there were ties between former Maze affiliates and Egregor. CERT-FR reporting cited in the content states that the Lockean affiliate group used Maze alongside Egregor, ProLock, REvil, and DoppelPaymer. Additional reporting in the content says DoppelPaymer used similar tactics and much of the same code as BitPaymer and Maze. The content further mentions Maze in connection with FIN7 affiliations in 2023, but does not provide technical detail tying FIN7 to Maze malware development itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The exploit was used in Maze and Egregor ransomware campaigns. | The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability... Actors exploiting this vulnerability commonly used the proof of concept code released by the security researcher... The exploit was used in Maze and Egregor ransomware campaigns.
"Since November 2019, we’ve seen the MAZE ransomware being used in attacks that combine targeted ransomware use, public exposure of victim data, and an affiliate model."
"Since November 2019, we’ve seen the MAZE ransomware being used in attacks that combine targeted ransomware use, public exposure of victim data, and an affiliate model."
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2023, FIN7 expanded its operations to include the deployment of ransomware through affiliations with RaaS groups such as REvil and Maze, while also managing its own RaaS programs, including the now-retired Darkside and BlackMatter.
In 2020 ELBRUS transitioned from using PoS malware to deploying ransomware as part of a financially motivated extortion scheme, specifically deploying the MAZE and Revil RaaS families.
Between June 2020 and March 2021, Lockean attacked at least seven more companies with various ransomware families: Maze, Egregor, ProLock, REvil.
Between June 2020 and March 2021, Lockean attacked at least seven more companies with various ransomware families: Maze, Egregor, ProLock, REvil.
"Since November 2019, we’ve seen the MAZE ransomware being used in attacks that combine targeted ransomware use, public exposure of victim data, and an affiliate model."
22 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.
Citrix ADC maintains a vulnerable Perl script (newbm.pl) that, when accessed via HTTP POST request ... allows local operating system (OS) commands to execute. Attackers can use this functionality to upload/execute command and control (C2) software ... and gain unauthorized access to the OS.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
“AppleJeus delivered components using a Windows Installer package (.msi)… executed the 3CXDesktopApp.exe…”, “APT38 has used msiexec.exe to execute malicious files.”, “Rancor has used msiexec to download and execute malicious installer files over HTTP.”, “TA505 has used msiexec to download and execute malicious Windows Installer files.”
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities... Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian... Clop has checked the keyboard language using the GetKeyboardLayout() function... Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.
Attackers move directly to deploying ransomware by editing a Group Policy.
Examples include 'Avaddon uses wmic.exe to delete shadow copies,' 'BlackCat can use wmic.exe to delete shadow copies on compromised networks,' and 'WannaCry utilizes wmic to delete shadow copies.'
The content repeatedly describes threat actors and malware disabling, stopping, uninstalling, or modifying antivirus, EDR, Windows Defender, AMSI, logging, and other security controls.
Examples include 'Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools', 'BlackByte disabled security tools such as Windows Defender', 'Scattered Spider has uninstalled and disabled security tools', and many malware families terminating AV/EDR processes or services.
74 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
90 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family referenced as a group FIN7 previously collaborated with (contextual association, not necessarily tied to the specific Veeam CVEs in this article).
Ransomware family referenced in connection with a rumored 2020 breach impacting Cognizant.
Ransomware referenced in the context of tactics involving disabling services prior to encryption.
References https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.