Threat Actor Update: Maze Ransomware Shuts Down Operations

On November 1, 2020, the Maze ransomware operators announced on their website that they are shutting down their ransomware operations. The news of the shutdown appeared shortly after the United States government officials warned the public about Ryuk ransomware attacks on hospitals and other healthcare providers. Since mid-September, the Maze team slowly tapered off publishing stolen data to their website, suggesting the actors were taking a break from distributing attacks, publishing stolen data, or updating the malware to handle more capabilities and functions. While the announcement indicated that Maze does not have any successors, and the so-called Maze Cartel never existed, it is rumored that affiliates of Maze are reportedly joining the Egregor ransomware operations likely suggesting that the group is merely shifting its operations elsewhere.

Alpha Team assesses that there most likely will be more consolidation of ransomware gangs within the next year, either to cash out or because they got better opportunities at larger operations. These larger operations will likely have a better Ransomware-as-a-Service (RaaS) affiliate model or require more vetting to join.

Recommendations

In the ZeroFOX platform, enabling the Cyber Attack Chatter Rule, implementing a custom rule to monitor for any company-specific leaked technical information, adding unique domains as Independent Search Terms under relevant entities, and adding verified accounts that you would like to monitor for mentions related to cyber reconnaissance
Keeping your security systems up to date with the latest detections
Maintaining secure backups of all business-critical information
Creating a robust network segmentation to help prevent lateral movement of hackers between business units

Details

On November 1, 2020, the Maze ransomware operators announced that they have completely shut down their website and attempted to dispel rumors that the "Maze Cartel" never existed, at the same time warning that any future links to their operations would be considered a scam. The official announcement also indicated that Maze’s operations were merely a demonstration of lax cyber security practices, reminding organizations to stay secure when handling clients' personal and financial data (Figure 1).

Figure 1: Maze press release. Source: Alpha Team/Cyveillance Research

Since the beginning of its almost year-long operation, Maze ransomware posed a serious threat to organizations and individuals. First discovered in late 2019 and previously known as the ChaCha ransomware, Maze initially infected victims through exploit kits and phishing campaigns before utilizing vulnerable software, such as remote desktop protocol (RDP) exploits, to distribute the malware. Most notably, Maze pioneered the use of novel extortion tactics in which it threatened to publish victims' information (or partially published such data) if they chose not to comply with the ransom demands. Such tactics have since been adopted by other ransomware families, such as Sodinokibi, Conti, Ragnar Locker, and SunCrypt and completely altered the ransomware threat landscape, making it more difficult for ransomware victims to recover from an attack.

Thus far in 2020, Maze has published stolen data from over 300 successful infections on its dedicated website. In March 2020, in light of the COVID-19 pandemic, several ransomware groups, including Maze, vowed not to target healthcare organizations until the pandemic was over. In light of the shutdown of Maze’s operations, its affiliates are reportedly joining the Egregor ransomware operations. Egregor emerged o in September 2020, and is allegedly based on the Sekhmet ransomware.

How it works

The Maze ransomware targets machines running Windows environments and is spread through infection vectors like exploited RDP endpoints, phishing emails, and exploit kits. In general, when Maze runs on a Windows machine, the malware will attempt to establish communication with a command and control location while encrypting all files on the machine using RSA-2048 encryption. Once the encryption process completes, the victim is presented with a ransom note containing instructions on how to contact the ransomware actors to pay the ransom demands. A screenshot of the Maze ransom note is displayed in Figure 2.

Figure 2: Maze ransom note. Source: Alpha Team/Cyveillance Research

Maze Cartel

In June 2020, the Maze team reportedly introduced a partnership program with other ransomware teams to publish stolen information from ransomware attacks dubbed the "Maze Cartel." The groups included within this program were LockBit ransomware, Ragnar Locker ransomware, and later SunCrypt ransomware. The launch of such partnership suggested that these ransomware groups could potentially increase profits from their attacks by working with the Maze team, who had established their ransomware as a prominent and sophisticated threat. In August 2020 security journalists interviewed members of the SunCrypt ransomware who claimed they joined the Maze Cartel because Maze operators allegedly could not handle the volume of victim extortions and needed assistance from other actors, indicating that they shared revenue from successful infections with Maze. However, according to the recent announcement by Maze, the Maze Cartel never existed claiming it was created by journalists who wrote about it.

Alpha Team Assessment

Since September, Maze has been removing victim lists from their website and closing their operations. There could be a number of factors going into their decision to close. With the security community and the news cycle being hyper-focused on ransomware infections, this could be an opportune time for some operators to jump ship with their earnings. According to Maze, some of their operators moved to other ransomware gangs. Alpha Team assesses that there most likely will be more consolidation of ransomware gangs within the next year, either to cash out or because they got better opportunities at larger operations. These larger operations will likely have a better Ransomware-as-a-Service (RaaS) affiliate model or require more vetting to join.

A recent video emerged where an alleged member of the REvil gang was interviewed by a Youtube channel.

Figure 3: Video Screenshot of Interview with Supposed REvil Member. Source: Youtube

In the video, the REvil member tells the interviewer that they have noticed the increased attention from the media and the security researcher community. This has caused them to have a more thorough vetting process for members, where they would ask questions only a native from a CIS country would know the answer to. Alpha Team has also observed potential recruiters for these gangs on vetted cybercrime forums, where they set up interviews based on toolsets used extensively by these gangs. They are also cognizant that law enforcement officials and security researchers are trying to infiltrate their group to collect information.

If this interviewer indeed found a member of the REvil gang, it has given valuable insight into the modus operandi of the REvil gang as well as other ransomware gangs. Maze most likely shares the same paranoia that REvil has, due to their common threat models.