Inactive ransomware operator
← All groupsMaze
59 victims indexed · first seen 7 years ago · last activity 6 years ago
At a glance
- Status
- inactive
- First seen
- 7 years ago
- Last activity
- 6 years ago
- Onion sites
- 1 known endpoint
- Primary sector
- Critical Manufacturing · 15 hits
About
References
112 linksExternal sources curated by the MISP threat-intel community.
- malpedia.caad.fkie.fraunhofer.de/details/win.maze
- bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/
- proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us
- techcrunch.com/2020/11/02/maze-ransomware-group-shutting-down
- fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- secureworks.com/research/threat-profiles/gold-village
- adversary.crowdstrike.com/adversary/twisted-spider/
- analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel
- analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf
- blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer
- blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis
- blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html
- blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/
- blog.talosintelligence.com/2019/12/IR-Lessons-Maze.html
- blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html
- blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html
- blogs.quickheal.com/maze-ransomware-continues-threat-consumers/
- cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf
- cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf
- docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3
Timeline
12 monthsTop countries
Top sectors
MITRE ATT&CK
14 techniques · 9 tacticsTactics
Techniques
- T1566Phishing
- T1190Exploit Public-Facing Application
- T1059Command and Scripting Interpreter
- T1055Process Injection
- T1548Abuse Elevation Control Mechanism
- T1562Impair Defenses
- T1027Obfuscated Files or Information
- T1003OS Credential Dumping
- T1021Remote Services
- T1135Network Share Discovery
- T1005Data from Local System
- T1039Data from Network Shared Drive
- T1041Exfiltration Over C2 Channel
- T1486Data Encrypted for Impact
Detection · YARA rules
2 rulesRansom_Maze
YARA rule from ATR/Trellix: ransomware/Ransom_Maze.yar
source: ATR/Trellix
Maze
YARA rule from Yara-Rules Community: malware/RANSOM_Maze.yar
source: Yara-Rules Community
Recent victims
Loading…
Onion infrastructure
1 known- http://xfr3txoorcyy7tikjgj5dk3rvo3vsrpyaxnclyohkbfp3h277ap4tiad.onion
Source
Updated 6 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
