Maze
MITRE ATT&CK: S0449 View on attack.mitre.org
Aliases: ChaCha, Maze
- First seen
- 2019-05-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 46 (43 malicious)
- Last IoC activity
- 2026-10-17 00:37:30
- Profile updated
- 2026-07-07 12:38:45
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications retail-and-hospitality manufacturing
Context
Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files on victim machines for impact, Maze operators conduct information stealing campaigns prior to encryption and post the information online to extort affected companies.
Recent IoC activity
43 malicious indicators in Maltiverse are attributed to Maze (S0449). The 20 most recently updated:
Detection coverage
- 4 YARA rules
- 565 Sigma rules
Malware & tools used
- Junk Code Insertion (attack-pattern)
- System Information Discovery (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Masquerade Task or Service (attack-pattern)
- System Language Discovery (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Run Virtual Instance (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- System Shutdown/Reboot (attack-pattern)
- Dynamic Resolution (attack-pattern)
- Native API (attack-pattern)
- Web Protocols (attack-pattern)
- Windows Command Shell (attack-pattern)
- Scheduled Task (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Process Discovery (attack-pattern)
- Indicator Removal (attack-pattern)
- Service Stop (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- Msiexec (attack-pattern)
- Inhibit System Recovery (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
Used by threat actors
Detection rules
- SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 (yara-rule)
- DITEKSHEN_MALWARE_Win_Maze (yara-rule)
- ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 (yara-rule)
- DITEKSHEN_INDICATOR_KB_ID_Ransomware_Maze (yara-rule)
Related threat objects
- Ragnar Locker (malware)
Reports & references
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
- proofpoint.com — First Step Initial Access Leads Ransomware (report)
- CrowdStrike — Ransomware Preparedness A Call To Action (report)
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 2 (report)
- analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
- statescoop.com — Baltimore Ransomware Crowdstrike Extortion (report)
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- CrowdStrike — Report2021Gtr (report)
- blog.chainalysis.com — Ransomware Connections Maze Egregor Suncrypt Doppelpaymer (report)
- bleepingcomputer.com — Ransomware Attackers Use Your Cloud Backups Against You (report)
- Mandiant — Financially Motivated Actors Are Expanding Access Into Ot (report)
- Mandiant — Financially Motivated Actors Are Expanding Access Into Ot (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Maze (report)
- bleepingcomputer.com — Maze Ransomware Now Delivered By Spelevo Exploit Kit (report)
- techcrunch.com — Maze Ransomware Group Shutting Down (report)
- Mandiant — Tactics Techniques Procedures Associated With Maze Ransomware Incidents (report)
- blog.minerva-labs.com — Egregor Ransomware An In Depth Analysis (report)
- Cisco Talos — Ir Lessons Maze (report)
- Cisco Talos — Ctir Quarterly Trends Q4 2020 (report)
- Cisco Talos — Quarterly Ir Report Fall 2020 Q4 (report)
- blogs.quickheal.com — Maze Ransomware Continues Threat Consumers (report)
- download.bitdefender.com — Bitdefender Trr Whitepaper Maze Creat4351 En En Genericuse (report)
- github.com — Maze.Md (report)
- github.com — Maze.Md (report)
- id-ransomware.blogspot.com — Chacha Ransomware (report)