{"id":44376,"date":"2020-11-09T03:47:00","date_gmt":"2020-11-09T08:47:00","guid":{"rendered":"http:\/\/blog.cybercon1.com\/?p=44376"},"modified":"2020-11-09T03:47:00","modified_gmt":"2020-11-09T08:47:00","slug":"maze-a-notorious-ransomware-group-says-its-shutting-down","status":"publish","type":"post","link":"https:\/\/blog.cyberconservices.com\/index.php\/2020\/11\/09\/maze-a-notorious-ransomware-group-says-its-shutting-down\/","title":{"rendered":"Maze, a notorious ransomware group, says it&#8217;s shutting down"},"content":{"rendered":"\n<p>Not sure I believe this but&#8230;<\/p>\n\n\n\n<p id=\"speakable-summary\">One of the most active and notorious data-stealing <strong>ransomware<\/strong> groups, Maze, says it is \u201cofficially closed.\u201d<\/p>\n\n\n\n<p>The announcement came as a waffling statement, riddled with spelling mistakes and published on its website on the dark web, which for the past year has published vast troves of stolen internal documents and files from the companies it targeted, including\u00a0<a href=\"https:\/\/techcrunch.com\/2020\/04\/18\/cognizant-maze-ransomware\/\">Cognizant<\/a>, cybersecurity insurance firm\u00a0<a href=\"https:\/\/techcrunch.com\/2020\/03\/26\/chubb-insurance-breach-ransomware\/\">Chubb<\/a>, pharmaceutical giant\u00a0<a href=\"https:\/\/techcrunch.com\/2020\/04\/27\/execupharm-clop-ransomware\/\">ExecuPharm<\/a>, Tesla and SpaceX parts supplier\u00a0<a href=\"https:\/\/techcrunch.com\/2020\/03\/01\/visser-breach\/\">Visser<\/a>\u00a0and defense contractor\u00a0<a href=\"https:\/\/techcrunch.com\/2020\/03\/26\/kimchuk-medical-military-ransomware\/\">Kimchuk<\/a>.  <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignleft size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.pixabay.com\/photo\/2010\/12\/13\/10\/05\/maze-2264__340.jpg\" alt=\"\" width=\"732\" height=\"291\"\/><\/figure><\/div>\n\n\n\n<p>Where typical <strong>ransomware <\/strong>groups would infect a victim with file-encrypting malware and hold the files for a ransom, Maze gained notoriety for first exfiltrating a victim\u2019s data and threatening to publish the stolen files unless the ransom was paid.<\/p>\n\n\n\n<p>It quickly\u00a0<a href=\"https:\/\/techcrunch.com\/2020\/01\/08\/as-ransomware-gets-craftier-companies-must-start-thinking-creatively\/\">became the preferred tactic<\/a>\u00a0of <strong>ransomware<\/strong> groups, which set up websites \u2014 often on the dark web \u2014 to leak the files it stole if the victim refused to pay up.<\/p>\n\n\n\n<p>Maze initially used exploit kits and spam campaigns to infect its victims, but later began using known security vulnerabilities to specifically target big-name companies. Maze was&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/ransomware-gang-publishes-tens-of-gbs-of-internal-data-from-lg-and-xerox\/\">known to use<\/a>&nbsp;vulnerable virtual private network (VPN) and remote desktop (RDP) servers to launch targeted attacks against its victim\u2019s network.<\/p>\n\n\n\n<p>Some of the demanded ransoms reached into the millions of dollars. Maze reportedly\u00a0<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/maze-ransomware-demands-6-million-ransom-from-southwire\/\">demanded $6 million<\/a>\u00a0from one Georgia-based wire and cable manufacturer, and\u00a0<a href=\"https:\/\/news.sophos.com\/en-us\/2020\/09\/22\/mtr-casebook-blocking-a-15-million-maze-ransomware-attack\/\">$15 million<\/a>\u00a0from one unnamed organization after the group encrypted its network. But after COVID-19 was declared a pandemic in March, Maze \u2014 as well as other <strong>ransomware <\/strong>groups \u2014 promised to\u00a0<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/ransomware-gangs-to-stop-attacking-health-orgs-during-pandemic\/\">not target hospitals<\/a>\u00a0and medical facilities.<\/p>\n\n\n\n<p>But security experts aren\u2019t celebrating just yet. After all, <strong>ransomware <\/strong>gangs are still criminal enterprises, many of which are driven by profit.  <a href=\"https:\/\/www.google.com\/url?rct=j&amp;sa=t&amp;url=https:\/\/techcrunch.com\/2020\/11\/02\/maze-ransomware-group-shutting-down\/&amp;ct=ga&amp;cd=CAEYACoUMTI1MTU3NTg2NDMxMzI2ODg0MzQyGmY5NWQ3ZDU3NzU5MmRlMjE6Y29tOmVuOlVT&amp;usg=AFQjCNGrfreBAUx0FxpWCAERHPMPfgS-vA\">Read On:<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Not sure I believe this but&#8230; One of the most active and notorious data-stealing ransomware groups, Maze, says it is \u201cofficially closed.\u201d The announcement came as a waffling statement, riddled with spelling mistakes and published on its website on the <span class=\"excerpt-dots\">&hellip;<\/span> <a class=\"more-link\" href=\"https:\/\/blog.cyberconservices.com\/index.php\/2020\/11\/09\/maze-a-notorious-ransomware-group-says-its-shutting-down\/\"><span class=\"more-msg\">Continue reading &rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[636],"tags":[637],"class_list":["post-44376","post","type-post","status-publish","format-standard","hentry","category-ransomware","tag-ransomware"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/posts\/44376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/comments?post=44376"}],"version-history":[{"count":0,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/posts\/44376\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/media?parent=44376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/categories?post=44376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.cyberconservices.com\/index.php\/wp-json\/wp\/v2\/tags?post=44376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}