Loading malware…
Maze is a Windows ransomware family first observed in May 2019, previously known as ChaCha ransomware. It was used in targeted, human-operated intrusions and is notable for popularizing double extortion: operators stole victim data before encrypting files, then threatened public disclosure through a leak platform if payment was withheld. Maze targeted enterprises and government-linked organizations across numerous sectors, including technology, healthcare, legal services, insurance, logistics, engineering, energy, and manufacturing. The operation also collaborated with other ransomware groups on shared data-leak infrastructure.
Maze has been delivered through malicious spam attachments, exploitation of vulnerabilities, network intrusion, exposed Remote Desktop Protocol services, fake websites, and exploit kits. It can use MSI packages executed through the signed Windows Installer utility. Affiliates have used credential dumping, network and RDP scanning, SMB-based movement, remote execution tooling, and Cobalt Strike during intrusions before ransomware deployment.
The malware uses a loader that decrypts and reflectively loads its main DLL payload from data concealed in an embedded image resource. It incorporates anti-analysis measures, including debugger-attachment interference and obfuscated API invocation, and avoids execution on systems configured for Russian and various CIS-region language settings. Maze enumerates processes and installed security products, terminates selected security, analysis, database, and business-application processes, deletes volume shadow copies, and encrypts local and network-share files using ChaCha-based cryptography. It stores key-related material in NTFS extended attributes, distributes ransom notes, changes the desktop wallpaper, and can play synthesized spoken ransom messages. It also establishes scheduled-task persistence and communicates host, operating-system, network, and security-product details to operator-controlled infrastructure. Maze’s victim portal supports victim identification, negotiation chat, and test decryption.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CYFIRMA’s researchers have tracked Maze as early as Jun last year, and on 10 Jun, Maze group have released a long list of companies who have fallen victim to their cyberattacks.
CYFIRMA’s researchers have tracked Maze as early as Jun last year, and on 10 Jun, Maze group have released a long list of companies who have fallen victim to their cyberattacks.
Maze tends to use known vulnerabilities like the Pulse VPN CVE-2019-11510 to break in and this means employees working from home must be mindful when accessing sensitive company information. | CYFIRMA’s researchers have tracked Maze as early as Jun last year, and on 10 Jun, Maze group have released a long list of companies who have fallen victim to their cyberattacks.
Example actor leveraging Metasploit for SMB scanning: use auxiliary/scanner/smb/smb_ms17_010
The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability if it improperly handles symbolic links... The exploit was used in Maze and Egregor ransomware campaigns. | The exploit was used in Maze and Egregor ransomware campaigns.
The servers were vulnerable to the CVE-2019-19781 vulnerability, which Mursch described as "Maze's favorite vector of compromise." | The operators of the Maze ransomware have published today tens of GB of internal data from the networks of enterprise business giants LG and Xerox following two failed extortion attempts.
Maze Ransomware now uses the Spelevo exploit kit in a new malicious campaign using a Flash Player vulnerability to attack users. When redirected to Spelevo, the exploit kit will attempt to use vulnerability CVE-2018-15982. Vulnerable users are Flash Player versions 31.0.0.153 / 31.0.0.108 and earlier. After successful exploitation, the exploit kit automatically downloads and installs the Maze Ransomware payload. | Maze Ransomware Aliases: Maze Locker, MazeLocker, ChaCha, ChaChaLocker ... Этот крипто-вымогатель шифрует данные бизнес-пользователей и компаний с помощью RSA + ChaCha20 ... Вымогатели, распространяющие Maze, могут публиковать украденные данные с целью усиления давления на жертву.
"Since November 2019, we’ve seen the MAZE ransomware being used in attacks that combine targeted ransomware use, public exposure of victim data, and an affiliate model."
14 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CYFIRMA’s researchers have tracked Maze as early as Jun last year, and on 10 Jun, Maze group have released a long list of companies who have fallen victim to their cyberattacks.
CYFIRMA’s researchers have tracked Maze as early as Jun last year, and on 10 Jun, Maze group have released a long list of companies who have fallen victim to their cyberattacks.
CYFIRMA’s researchers have tracked Maze as early as Jun last year, and on 10 Jun, Maze group have released a long list of companies who have fallen victim to their cyberattacks.
"305419896": "Ryuk/TrickBot/Maze/EvilCorp/Pyxie/APT41 - Stats uniques -> ips/hostnames: 344 publickeys: 200"
Maze ransomware doesn’t just demand payment for a decryptor but exfiltrates victim data and threatens to leak it publicly if the target doesn’t pay up.
La campagne d’attaques délivrant Egregor serait liée à la fin d’activité du groupe d’attaquants à l’origine du rançongiciel Maze.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Mazeランサムウェアのメインモジュールはその後、 WMI クエリを使用してボリュームシャドウコピーを削除します。
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
This means it is leveraged post initial access phase, frequently reported to be through RDP[5,6].
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
リソースセクションの画像の後半部分からロードしたデータはまず XOR で復号されます。XORで復号された後のデータは Base64 文字列となっています。
Mazeランサムウェアの EXE ファイルには PNG 画像がリソースセクションに埋め込まれており、メインモジュール (DLL) はその画像の中に多重に暗号化され保存されています。
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Mazeランサムウェアのメインモジュールはその後、 WMI クエリを使用してボリュームシャドウコピーを削除します。これによってシステムの復元によるデータ復旧が行えなくなります。
This particular campaign includes a signed DLL payload (kepstl32.dll).
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).
Mazeランサムウェアには感染を停止させる「キルスイッチ」が2つ存在します。1つ目は、端末内に「 C:\JDUIHiuf\IDisjopjcnb 」というファイルが存在した場合、感染を行わずすぐに終了します。2つ目に用意されているのは、実行引数に「 --DIdsjdjdj 」という文字列が含まれていた場合で、こちらも同様に感染を行わずすぐに終了します。
NtSetEaFile という API を使用して見えないように上記のファイルの NTFS ファイルシステムの拡張ファイル属性( extended file attribute )という隠された領域に中に埋め込んでいます。
VirtualProtect を使用して ntdll の DbgUiRemoteBreakin という関数のアドレス帯のアクセス権を PAGE_EXECUTE_READ から PAGE_EXECUTE_READWRITE に変更し、開始アドレスの命令を 0x6C から 0xC3(ret 命令 ) へ 1 バイト書き換えます。
例えば、ユーザ名が「 Taro 」の場合、以下のようなセリフが合成音声により繰り返し再生されます。 Taro Alert! Taro Alert! Dear Taro Your files have been encrypted by Maze ransomware!
以下はプロセス検索を行う際に使用する CreateToolhelp32Snapshot の API を呼び出す際の処理を抜粋していますが、無駄なジャンプを重ね API コールが簡単に見えないようにしています。
上記の通信では、感染端末の環境に関わる情報(コンピュータ名や OS 情報、ネットワーク情報、先ほど取得したアンチウイルス製品情報)が送信されます。
Mazeランサムウェアには感染を停止させる「キルスイッチ」が2つ存在します。1つ目は、端末内に「 C:\JDUIHiuf\IDisjopjcnb 」というファイルが存在した場合、感染を行わずすぐに終了します。2つ目に用意されているのは、実行引数に「 --DIdsjdjdj 」という文字列が含まれていた場合で、こちらも同様に感染を行わずすぐに終了します。
As with previous variants of Maze, the trojan will attempt to inhibit recovery by deleting shadow copies via WMIC.exe ( wmic.exe shadowcopy delete )
The FBI, CISA, and MS-ISAC have received numerous reports of ransomware attacks against K-12 educational institutions. | malicious cyber actors target school computer systems, slowing access, and—in some instances—rendering the systems inaccessible for basic functions, including distance learning.
177 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another ransomware family that combines encryption with data extortion/publication pressure.
Ransomware first observed in May 2019 that encrypts files, drops ransom notes, deletes shadow copies to inhibit recovery, and exfiltrates victim data for double-extortion by threatening public leaks.
Ransomware family mentioned as targeting healthcare and medical facilities during the COVID period.
A ransomware family referenced as a collaborator and technical influence on Conti, including shared negotiations and access to a Maze build for reverse engineering and improvement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.