Maze Ransomware

The recent spread of ransomware has kickstarted many companies into reevaluating their current cybersecurity maturity. It has come to be generally accepted that appropriate investment in offline backups will render most ransomware attacks ineffective. The victim may still spend time and money investigating how the infection started, if and what data was exfiltrated, and how to prevent a future incident, but in the end, access to the data is not lost.

Criminals have realized that for their malware campaigns to remain effective in today's cyber landscape, they must constantly evolve their tactics and techniques. New techniques include a data exfiltration step as part of the ransomware infection. If the ransom is not paid, the attackers threaten to release the victim’s data onto the public internet. While variants of ransomware have made these threats in the past, a new ransomware known as Maze has become the first to actually publish data from alleged victims.

The Origins of Maze

The Fallout exploit kit first appeared for sale in September 2018, with a good deal of interest from the cyber crime community. An exploit kit is a way to automatically and silently exploit a victim's computer, and is often placed within a compromised website. When a user visits the site, the kit scans for any vulnerable browser-based applications that it can exploit. If the system is patched, it may attempt a social engineering attack on the user. Maze infected its first victim in October of 2019, having been spread by the Fallout exploit kit, hacked RDP connections, and phishing campaigns impersonating government employees.

The original Fallout Exploit Kit thread. There were over 125 replies of interested buyers.

How Maze Works

After gaining access to the machine, the attackers export any data they want and drop the ransomware portable executable on the computer. Following data exfiltration, the ransomware executable first deletes any backups that are stored on the computer and then encrypts all files with the ChaCha algorithm. Finally, it re-encrypts the ChaCha keys with RSA-2048, and appends each file with a random extension. A simple text file named “DECRYPT-FILES.txt” providing instructions for contacting the Maze organization is placed in each of the directories. This sequence of operations renders the data impossible to decrypt without paying the attacker.

Minutes after the portable executable runs, the user’s desktop background is changed with an explanation of what happened.

The ransom note that is dropped in all the user directories.

Each user is given a url with a unique path that corresponds to the victim. The website contains five different tabs.

A live chat to negotiate with the criminals.

The site allows for three image files to be decrypted.

Exchanges where the victim can purchase bitcoins.

Links to news articles about the ransomware.