Maze Ransomware Expanded Double-Extortion Tactics and Targeted Intrusions

The Maze ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments.

Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through Remote Desktop Protocol (RDP) access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, HTTP POST data exfiltration, and file encryption based on RSA and ChaCha20, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.