Maze

Description

Maze is a ransomware operation that pioneered data exfiltration and double extortion, publishing stolen files from victims who refused to pay. Its affiliates compromised large organizations through phishing, exploits, and purchased access, and its high profile attacks made ransomware a boardroom concern. The group announced its shutdown in late 2020, and its affiliates and tactics flowed into successor operations such as Egregor, a pattern that repeated across the industry.

Stats

First seen: February 2022
Last seen: October 2026

MITRE ATT&CK techniques

23 techniques across 7 tactics.

TA0002 Execution

T1047Windows Management Instrumentation
T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.016Junk Code Insertion
T1027Obfuscated Files or Information
- T1027.016Junk Code Insertion
T1036Masquerading
- T1036.004Masquerade Task or Service
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1070Indicator Removal
T1218System Binary Proxy Execution
- T1218.007Msiexec
T1564Hide Artifacts
- T1564.006Run Virtual Instance

TA0007 Discovery

T1049System Network Connections Discovery
T1057Process Discovery
T1082System Information Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1568Dynamic Resolution

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1529System Shutdown/Reboot

TA0112 Defense Impairment

T1685Disable or Modify Tools

Associated groups

Alert name variants

Alert Name	Engine
DeepScan:Generic.Ransom.Maze.28646622	AV
DeepScan:Generic.Ransom.Maze.9C73E1EE	AV
DeepScan:Generic.Ransom.Maze.D88EAA85	AV
Dump:Generic.Ransom.Maze.28646622	AV
Dump:Generic.Ransom.Maze.34659D46	AV
Dump:Generic.Ransom.Maze.9C73E1EE	AV
Dump:Generic.Ransom.Maze.D88EAA85	AV
Gen:Variant.Ransom.Maze.11	AV
Gen:Variant.Ransom.Maze.2	AV
Gen:Variant.Ransom.Maze.5	AV
Gen:Variant.Ransom.Maze.8	AV
Generic.Ransom.Maze.0915DA0D	AV
Generic.Ransom.Maze.7E0EDD00	AV
Generic.Ransom.Maze.89157CD4	AV
Generic.Ransom.Maze.DB9E6C0C	AV
Generic.Ransom.Maze.Packed.002A5127	AV
Generic.Ransom.Maze.Packed.01627868	AV
Generic.Ransom.Maze.Packed.029B1776	AV
Generic.Ransom.Maze.Packed.0DD86C08	AV
Generic.Ransom.Maze.Packed.0ECFB20A	AV
Generic.Ransom.Maze.Packed.4CD9E4BC	AV
Generic.Ransom.Maze.Packed.4F6FADBE	AV
Generic.Ransom.Maze.Packed.67C2B74A	AV
Generic.Ransom.Maze.Packed.6B3C989D	AV
Generic.Ransom.Maze.Packed.6BFE7F38	AV
Generic.Ransom.Maze.Packed.79F56522	AV
Generic.Ransom.Maze.Packed.7A61F6D2	AV
Generic.Ransom.Maze.Packed.7E329C77	AV
Generic.Ransom.Maze.Packed.84CA330C	AV
Generic.Ransom.Maze.Packed.A5453211	AV
Generic.Ransom.Maze.Packed.CCB0F49B	AV
Generic.Ransom.Maze.Packed.D819B262	AV
Generic.Ransom.Maze.Packed.DF5582B7	AV
Generic.Ransom.Maze.Packed.EA1C2E0F	AV
Generic.Ransom.Maze.Packed.EA2AF702	AV
Generic.Ransom.Maze.Packed.EB6DB2E5	AV
Generic.Ransom.Maze.Packed.EF3434C2	AV
Generic.Ransom.Maze.Packed.F7295998	AV
Win32.Ransomware.Maze	ATP Sandbox Adv. Heuristics
Win32.Trojan.Maze	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Win.Trojan.Maze variant download attempt	IPS-SWG