MazeMalware
- ChaCha
Maze Ransomware encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. The ransom note is placed inside a text file and an htm file. There are a few different extensions appended to files which are randomly generated. Actors are known to exfiltrate the data from the network for further extortion.From MISP Galaxy
Last reported 13 days ago, by Elastic Security Labs9 reports
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“It was used by the threat actors to modify registry and firewall rules to enable connections via Remote Desktop Protocol.”
- T1036Masquerading
“Masquerading”
- T1110Brute Force
“This fact is very important from the TTPs perspective: on rare occasions, the initial access is gained through a brute force attack against public-facing RDP-servers or just using valid accounts obtained from a third party.”
- T1053.005Scheduled Task
“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
- T1684Social Engineering
“Social Engineering”
- T1005Data from Local System
“Data from Local System”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Auditing the auditor: Unmasking Apex Accelerator“Afterward, CloudSyncD combines these two datasets with their collected fields into JSON, which is encrypted using ChaCha and then encoded with Base64 and sent out to the following URL in a POST request:”
-
The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation“Obfuscator variant 3: Dispatch Maze”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“ALPHV ransomware is written in Rust and uses AES or ChaCha to encrypt the victim’s data.”
-
Obscura, an Obscure New Ransomware Variant“That shared secret along with a 24 byte random nonce are used as the parameters for the ChaCha file encryption.”
-
Time to Ransom is Money“Ransomware actors like Phobos and Maze carried out more than 30 actions on average before deploying ransomware.”
-
Navigate SocGholish with Huntress“Navigating the Maze of SocGholish with Huntress: A Practical Guide”
-
REvil Twins: Ransomware-as-a-Service program“In the past, IcedID was known to have been used by Maze, Egregor and Conti affiliates, while Qakbot – by ProLock, Egregor and DoppelPaymer.”
-
The Locking Egregor“We noticed that the sequence of language checks is very similar to Sekhmet and Maze ransomware.”
-
Huntress Service: Ransomware Canaries“From CryptoLocker to Locky to Sodinokibi to Maze, ransomware has been a staple in the hacker-verse for a long time.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- c00a2d757349bfff…3d20dc7aac23in 1 report
- hxxps://racerex[.]com/its-fire-up-season/in 1 report
- racerex[.]comin 1 report
- assay.porchlightcommunity[.]orgin 1 report
- hxxps://obf-io.deobfuscate[.]io/in 1 report
- obf-io.deobfuscate[.]ioin 1 report
- hxxps://vrf.apexaccs[.]org/api/v1/vrfin 1 report
- vrf.apexaccs[.]orgin 1 report
- hxxps://verify.apexfdn[.]xyz/macos/installer/terminal/interactive/bashin 1 report
- verify.apexfdn[.]xyzin 1 report
- hxxps://arena.apexaccs[.]org/dashboard/pilotin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.