Loading malware…
Mauri is an open-source ransomware project originally developed by mauri870 for research purposes. Its publicly available source code has been repurposed by threat actors, including Mimo, which used it under the name Mimus. Mauri targets Windows systems and supports configurable file encryption and ransom messaging. An examined customized sample used AES-256 in CTR mode and targeted a broad range of documents, archives, databases, source code, executables, media, and backups. Its configuration excluded selected system, application, temporary, and user directories and included attacker-controlled contact and cryptocurrency payment details.
Mauri has been found on attacker-controlled infrastructure associated with suspected exploitation of Apache ActiveMQ vulnerability CVE-2023-46604 against systems in South Korea. That activity involved creation of backdoor accounts and deployment of Frpc to expose remote desktop access; the same infrastructure also hosted Quasar RAT. Mauri's deployment and file encryption were not confirmed in the investigated attacks, so its presence on the server does not establish ransomware execution against those victims. No specific industry targeting or definitive attribution was established for that activity.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Although actual attack cases have not yet been confirmed, Mauri ransomware has been uploaded to the download server.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.