Maze Ransomware

the attackers created a fake Abra cryptocurrency site to buy ad network traffic which was later used to redirect visitors to the exploit kit landing page under certain conditions.

Past Maze infections have been traced back to exploit kits, unsecured remote desktop connections, impersonation emails and compromised email accounts via malicious Word documents.

The distribution tactic of the Maze ransomware initially involved infections via exploit kits (namely, Fallout EK and Spelevo EK), as well as via spam with malicious attachments.

Maze tends to use known vulnerabilities like the Pulse VPN CVE-2019-11510 to break in

Maze Ransomware usually deploy phishing emails with MS Office attachments and fake/phishing websites laced with Exploit Kits.

Maze Ransomware usually deploy phishing emails with MS Office attachments

The threat actor group APT28 leverages TTPs like obfuscated files or information, PowerShell, exploitation of remote services for lateral movement, credential stealing through spear-phishing links

The threat actor group APT28 leverages TTPs like obfuscated files or information, PowerShell

If they fall for it, the malicious macro contained inside the document will execute, which in turn will result in the victim’s PC being infected with Maze ransomware.

Past Maze infections have been traced back to exploit kits, unsecured remote desktop connections, impersonation emails and compromised email accounts via malicious Word documents.

compromised email accounts via malicious Word documents

Past Maze infections have been traced back to exploit kits, unsecured remote desktop connections, impersonation emails and compromised email accounts via malicious Word documents.

The IP addresses <Details Masked> mentioned in Cognizant attack vector was seen exploiting two old vulnerabilities CVE-2016-7255 and CVE-2018-8453. Both these Win32k Elevations of Privilege Vulnerabilities

once admin privileges are achieved the groups exfiltrates information and deploy the maze ransomware

The threat actor group APT28 leverages TTPs like obfuscated files or information

The Maze ransomware is typically distributed as a PE binary (EXE or DLL depending on the specific scenario) which is developed in C/C++ and obfuscated by a custom protector.

To counter dynamic analysis, this Trojan will also terminate processes typically used by researchers, e.g. procmon, procexp, ida, x32dbg, etc.

During these stages, the use of the following tools has been observed: mimikatz, procdump, Cobalt Strike, Advanced IP Scanner, Bloodhound, PowerSploit, and others.

When executing on a machine, Maze ransomware will also attempt to determine what kind of PC it has infected. It tries to distinguish between different types of system (‘backup server’, ‘domain controller’, ‘standalone server’, etc.).

During these stages, the use of the following tools has been observed: mimikatz, procdump, Cobalt Strike, Advanced IP Scanner, Bloodhound, PowerSploit, and others.

Weak RDP credentials on machines accessible from the internet also pose a threat as the operators of Maze may use this flaw as well.

The threat actor group APT28 leverages TTPs like obfuscated files or information, PowerShell, exploitation of remote services for lateral movement

The threat actor group APT28 leverages TTPs like obfuscated files or information, PowerShell, exploitation of remote services for lateral movement, credential stealing through spear-phishing links and data-staged techniques.

During these intermediate stages, the threat actors attempt to identify valuable data stored on the servers and workstations in the compromised network.

Before encrypting a victim's network, most network-targeting ransomware operations will steal a victim's unencrypted files.

Maze ransomware operators are known to launch their attack under the surface and have a history of first stealing the data before locking their target devices.

Researchers said that Maze’s operators have since created a dedicated web page, which lists the identities of their non-cooperative victims and regularly publishes samples of the stolen data.

Maze ransomware operators are known to launch their attack under the surface and have a history of first stealing the data before locking their target devices.

The modus operandi of Maze hackers would entail releasing threats of data dump on public forum if ransom is not paid.