Maze

Maze is a ransomware family and ransomware-as-a-service operation first branded as Maze in May 2019 and previously referred to as “ChaCha ransomware.” It became one of the earliest and most prominent double-extortion ransomware operations, stealing victim data and threatening public disclosure if ransom demands were not met. Public reporting in the provided content states that leak-based extortion ransomware tactics were pioneered around November 2019 by Maze. Maze operated victim negotiation infrastructure and a separate public leak/news site on Tor and the public Internet, used DECRYPT-FILES.txt as its ransom note, and in some cases dropped 000.bmp as wallpaper and played a synthesized voice alert via the Microsoft Speech API.

Maze has been delivered through multiple vectors including exploit kits, spam/phishing emails, Remote Desktop Protocol attacks, and other network exploitation methods. One documented infection chain used malicious Microsoft Word attachments that required users to enable macros; the macro then launched PowerShell to download and install the Maze payload. Proofpoint-linked TA2101 campaigns in October-November 2019 impersonated German and Italian tax authorities and delivered Maze through Word documents and PowerShell downloaders. Initial Maze samples were also associated with fake websites loaded with exploit kits.

Technically, Maze is described as mostly written in C++ with heavy assembly use and control-flow obfuscation. It dynamically resolved APIs by hashing names and matching exports before using LoadLibrary and GetProcAddress. It included anti-analysis and evasion features such as IsDebuggerPresent checks, PEB.BeingDebuggedFlag checks, process-name detection for tools including procmon, x32dbg, x64dbg, ollydbg, and procexp, and disabling of dynamic analysis and security tools including IDA debugger, x32dbg, and OllyDbg. The content also states that Maze disabled Windows Defender Real-Time Monitoring and attempted to disable endpoint protection services.

Maze performed selective execution checks by calling GetUserDefaultUILanguage and terminating if the system language matched a predefined exclusion list. It established persistence through a Windows autorun registry entry and also created scheduled tasks using names such as “Windows Update Security” to launch at a specific time. For reconnaissance and defense evasion, Maze queried antivirus products through WMI root\SecurityCenter2, used WMI to connect a virtual machine to the victim organization’s network domain, and communicated with hard-coded IP addresses over HTTP, including HTTP POST exfiltration over port 80 using WS2_32.dll. FireEye reporting cited in the content states that the Maze group also used RDP over the Ngrok service as an alternative command-and-control channel.

Maze attempted to impair recovery by deleting shadow volumes, including once before and once after encryption. The content specifically notes use of WMIC.exe and WMI for shadow copy deletion, and use of Wow64RevertWow64FsRedirection after deletion attempts to restore filesystem redirection state. For encryption, Maze used RSA and ChaCha20, skipped specific directories and file types, and dropped DECRYPT-FILES.txt ransom notes.

Maze is associated in the content with financially motivated extortion activity and broad enterprise targeting, with explicit references to attacks affecting healthcare during the COVID-19 period. Reported victims in the provided material include Allied Universal, Canon, Southwire, the City of Pensacola, LG Electronics, Xerox, and healthcare organizations. Canon reporting in the content states Maze claimed to have stolen 10 TB of data before deploying encryption. The content also notes that Maze announced in March 2020 that it would stop attacks on medical organizations until the COVID-19 situation stabilized, and that it withdrew pressure in at least one case involving the City of Pensacola.

The provided content also links Maze to the broader ransomware ecosystem. Multiple intelligence and security companies believed there were ties between former Maze affiliates and Egregor. CERT-FR reporting cited in the content states that the Lockean affiliate group used Maze alongside Egregor, ProLock, REvil, and DoppelPaymer. Additional reporting in the content says DoppelPaymer used similar tactics and much of the same code as BitPaymer and Maze. The content further mentions Maze in connection with FIN7 affiliations in 2023, but does not provide technical detail tying FIN7 to Maze malware development itself.