Loading story…
Master decryption keys for the Maze, Egregor, and Sekhmet ransomware families were publicly leaked on the BleepingComputer forums by a user calling themselves "Topleak," who claimed to be the developer behind all three operations. The leak reportedly included multiple RSA-2048 master keys associated with affiliates, and one report said it also contained source code for the M0yv malware used by the Maze operation. The poster said the release was intentional and not the result of recent law-enforcement arrests or infrastructure seizures.
Researchers Michael Gillespie and Fabian Wosar reviewed the material and confirmed the keys were legitimate, allowing recovery of files encrypted by the three ransomware strains. Emsisoft then released a free decryptor for victims of Maze, Egregor, and Sekhmet. The disclosures also reinforced the close relationship among the families, with reporting noting Maze’s evolution into Egregor and code similarities linking Egregor, Sekhmet, and Maze.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
A user named "Topleak" posted master decryption keys for Maze, Egregor, and Sekhmet on the BleepingComputer forums, claiming to be the developer behind all three operations and saying the leak was intentional and unrelated to recent law-enforcement actions. The leak also included M0yv malware source code and claims that the gangs would not return and their source code had been destroyed.
A todo.txt file included with the leaked M0yv malware source indicated the code was last updated on January 19, 2022.
Several members of the Egregor group were arrested in Ukraine, an event later linked to the group's disappearance.
The articles state that the Maze operation rebranded as Egregor in September 2020.
The Sekhmet ransomware operation launched in March 2020 while Maze was still active.
Maze announced its shutdown in late 2020; one reference places the announcement in October 2020 while another says operators officially shut down in November 2020.
The Maze ransomware operation began operating in May 2019 and later became notable for shaping subsequent ransomware tactics.
At the end of 2019, Maze added data theft to its attacks and threatened to publish stolen data if victims refused to pay, helping popularize the double-extortion model.
After the leaked keys were validated, Emsisoft released a free decryptor for victims of Maze, Egregor, and Sekhmet ransomware.
Emsisoft researchers Michael Gillespie and Fabian Wosar reviewed the leaked keys and confirmed they were legitimate and could decrypt files encrypted by Maze, Egregor, and Sekhmet.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.co
Open sourcebleepingcomputer.com
Open sourceemsisoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **Maze ransomware** was delivered through the **Spelevo exploit kit**, which abused `CVE-2018-15982`, a critical Adobe Flash Player flaw, to execute code and install the payload. Once launched, Maze encrypted files with **RSA** and **ChaCha20**, dropped the `DECRYPT-FILES.txt` ransom note, and directed victims to both Tor and clear-web payment portals that offered live chat and limited test decryption. Researchers also linked Maze to earlier delivery through the **Fallout exploit kit**, showing that the operators used multiple infection channels to spread the malware. Separate incident-response findings showed Maze operators evolving beyond simple encryption into **targeted intrusions** that paired ransomware with **data theft and extortion**. Cisco Talos observed attackers using **Cobalt Strike** after initial access, moving laterally for at least a week, logging in interactively over **RDP**, executing remote PowerShell through **WMIC**, compressing stolen data with **7-Zip**, and exfiltrating it via PowerShell to a remote FTP server before deploying the ransomware. The activity reflected a broader shift in ransomware operations toward stealing sensitive files first and then threatening public release to increase pressure on victims.
Aug 15, 2026
Egregor emerged as a ransomware-as-a-service operation tied to the **Sekhmet/Maze** lineage and rapidly targeted organizations worldwide, including at least **69 victims** observed by France’s ANSSI, with some ransom demands exceeding **$4 million**. The group encrypted files with randomized extensions, dropped the ransom note `RECOVER-FILES.txt`, and threatened to publish stolen data within three days if victims did not negotiate through Tor-based payment and chat portals. Researchers linked Egregor to former Maze affiliates based on code overlap, shared infrastructure, similar ransom notes, and the migration of operators after Maze’s shutdown. Intrusions commonly began with phishing or illicit **RDP** access and frequently involved **Qakbot**, **IcedID**, **Ursnif**, **Cobalt Strike**, **AdFind**, **SharpHound**, **PsExec**, and **RClone** for reconnaissance, lateral movement, and exfiltration before encryption. Technical analyses described obfuscated DLL payloads, process injection, defense evasion, shadow-copy deletion, and file encryption using **ChaCha** with **RSA-2048**, while the malware avoided systems configured for several CIS-region languages. Egregor was linked to attacks on organizations including **GEFCO, Barnes & Noble, and Ubisoft**, and operated a public leak site—described by some researchers as a **“Hall of Shame”**—to pressure non-paying victims.
Aug 15, 2026
Maze and Ragnar Locker were reported using increasingly sophisticated **double-extortion** tactics that combined data theft, public leak threats, and defense evasion during ransomware intrusions. Maze operators were linked to incidents including the attack on **Cognizant** and the publication of **2GB** of allegedly stolen files from the **City of Pensacola**, underscoring that victims faced both operational disruption and potential data-breach exposure. Reporting also tied Maze to intrusion activity using exposed **RDP**, signed **Cobalt Strike** payloads, **ngrok** tunneling, remote execution with `mshta`, and tailored persistence mechanisms, with one investigated intrusion stopped before encryption was launched. A key technical shift was the adoption of **virtual-machine-based encryption** to bypass endpoint defenses. In a Sophos-investigated case, Maze failed twice after security software blocked ransomware launched through scheduled tasks, then succeeded in deploying an **MSI** package that installed **VirtualBox** and a customized **Windows 7** VM, mounted host drives, and encrypted files from inside the guest system. That approach mirrored **Ragnar Locker**, which had already used a smaller **Windows XP** VirtualBox image to make encryption appear to come from a trusted process while continuing its broader playbook of RDP-driven access, lateral movement, shadow-copy deletion, service termination, and **Salsa20** plus **RSA-2048** encryption backed by leak-site extortion.
Aug 15, 2026