M0yv

M0yv is a modular x86/x64 Windows file-infector malware associated with the Maze ransomware ecosystem. It targets Portable Executable files on Windows and has been described as a file-infecting virus that can extend beyond simple parasitic infection to function as a dropper and remote access trojan. Publicly discussed source code attributed to the Maze operation indicates that M0yv formed part of that group’s broader tooling arsenal.

A notable feature of M0yv is its domain generation algorithm, which produces pseudo-random command-and-control domains from embedded seeds. Research on the malware’s DGA and subsequent sinkholing activity indicates that M0yv used algorithmically generated domains to support resilient network communications and hinder straightforward infrastructure blocking. This behavior aligns with its use as a backdoor-capable platform rather than a purely destructive or self-contained file infector.

M0yv is primarily a Windows threat and is notable for combining classic file-infection behavior with modular post-compromise functionality. High-confidence reporting links it to the Maze gang, a major ransomware operation that also developed or operated Maze, Egregor, and Sekhmet-related tooling. The malware’s role within that ecosystem suggests use in intrusion support, payload delivery, and remote control on compromised Windows systems.