maze_ransomware · threatengine.sh

Maze (also tracked as ChaCha ransomware, Twisted Spider [CrowdStrike], Maze Cartel, Egregor Successor, Sekhmet Successor, and MITRE ATT&CK G0094) was one of the most historically important and analytically foundational ransomware operations in the publicly-tracked record, a financially-motivated organized cyber-criminal cluster operating from Russia and adjacent post- Soviet states from approximately May 2019 through November 2020 (approximately eighteen months of sustained operations). The cluster terminated via voluntary operator-initiated cluster shutdown rather than law-enforcement action, an analytically unusual pattern relative to subsequent contemporary ransomware operations. The cluster pioneered two major operational innovations that fundamentally restructured the contemporary ransomware ecosystem: First, and most operationally consequential, the double- extortion model introduction (November 2019).

Prior to Maze's innovation, ransomware operations relied predominantly on the encryption-and-decryption-key-sale extortion model alone. In November 2019, following the Maze attack against Allied Universal (US private security firm), Maze operators published approximately 700MB of stolen Allied Universal data on a public website when Allied Universal refused to pay ransom, establishing the data- publication-threat extortion pattern. Maze subsequently launched the dedicated Maze News leak site for systematic victim data publication.

The double-extortion model fundamentally restructured the ransomware ecosystem, by November 2020 the majority of major ransomware operations had adopted double-extortion tradecraft, and the model has remained the dominant operational pattern across the subsequent 2020-2025 ransomware ecosystem. This innovation represents the most operationally consequential single tradecraft introduction in the publicly-tracked ransomware ecosystem. Second, the Maze Cartel multi-operator coordination model (June 2020).

Maze publicly announced coordination with other contemporaneous ransomware operations including LockBit, RagnarLocker, and SunCrypt, forming the "Maze Cartel." The cartel coordination included shared leak-site infrastructure (Maze published stolen data from cartel-partner victims on the Maze News leak site), shared operational tradecraft, and apparent coordination of victim-targeting and ransom-negotiation tradecraft. The Maze Cartel was the first publicly-tracked example of multi-operator ransomware cluster coordination and established a meaningful operational-doctrine data point about how organized cybercrime clusters can coordinate operations beyond conventional affiliate-and-administrator models. The cartel model has not been widely replicated in subsequent contemporary ransomware operations (the broader ecosystem has trended toward affiliate-recruitment-competition rather than cartel-coordination), but the Maze Cartel remains analytically interesting historical reference.

High-profile documented Maze victims include

Allied Universal (November 2019, ransom-refusal triggering double-extortion model introduction)
Cognizant US IT services provider (April 2020, ~$50-70M USD financial impact disclosed)
Xerox (July 2020, ~100GB of stolen data published)
Canon (August 2020, multiple Canon services affected including image.canon photo-storage platform)
LG Electronics (June 2020)
Conduent business-services provider (May 2020)
and approximately 280+ additional commercial victims during the operational lifespan The cluster's voluntary November 1, 2020 operator-initiated shutdown was unusual in the publicly-tracked ransomware record , most major ransomware operations terminate via law-enforcement disruption, operator exit-scam, or internal exposure rather than voluntary operator-initiated shutdown. Maze operators publicly described the shutdown as completion of a planned operational lifespan rather than response to external pressure.

Personnel and tooling subsequently migrated to successor brands

Egregor (operational November 2020.
February 2021), most operationally consequential Maze successor. Operated aggressively for ~three months including high-profile attacks against Crytek, Ubisoft, Kmart, Randstad, and Translink Vancouver. Ukrainian National Police conducted February 2021 arrests of individuals suspected of involvement in Egregor operations, effectively terminating the Egregor brand.
Sekhmet (operational selectively 2020-2021)
Broader personnel diaspora into the Russia-speaking organized cybercrime ecosystem Operationally the cluster's initial-access tradecraft centered on spear-phishing, exploit-kit drive-by-downloads (notably Fallout and Spelevo exploit kits during 2019-2020), and selective exploitation of disclosed n-day vulnerabilities including Pulse Connect Secure CVE-2019-11510 and Citrix ADC CVE-2019-19781. Tooling included the Maze ransomware (originally ChaCha-named), Cobalt Strike Beacon, Mimikatz, BloodHound, and standard commodity post-exploitation tooling. A handful of operational notes: First, the cluster represents the single most operationally consequential historical reference cluster in the publicly-tracked ransomware record. The double-extortion model innovation (November 2019) fundamentally restructured the contemporary ransomware ecosystem and remains the dominant operational pattern across the 2020-2025 era. Every subsequent ransomware cluster covered in this corpus (LockBit, ALPHV / BlackCat, Cl0p, Black Basta, Akira, Play, Medusa, Rhysida, Royal / BlackSuit, RansomHub, Qilin, Hive, and others) operates the double-extortion model that Maze pioneered. Defender threat-modeling and policy-maker analytical frameworks for ransomware operations must engage with the double-extortion model, meaning analytical engagement with Maze as foundational reference is essential. Second, the Maze Cartel coordination model (June 2020) represents an analytically interesting historical data point about how organized cybercrime clusters can coordinate operations. While the cartel model has not been widely replicated, the underlying analytical questions about multi-operator coordination remain relevant for understanding contemporary cluster-ecosystem dynamics including affiliate-broker relationships across ransomware operations and shared-tooling-and-tradecraft patterns visible across the broader Russia-speaking organized cybercrime ecosystem. Third, the voluntary operator-initiated shutdown pattern (November 2020) represents an analytically unusual termination model in the publicly-tracked ransomware record. Most contemporary cluster terminations follow law-enforcement disruption (LockBit Operation Cronos, Hive Operation Hive Killer, ALPHV Operation Cookie Monster), operator exit-scam (ALPHV March 2024), or internal- exposure-driven degradation (Conti post-ContiLeaks, Black Basta post-BlackBastaLeaks). The voluntary-shutdown pattern is unique in the publicly-tracked record and contributes to the broader analytical question of whether Maze operators were responding to non-public law-enforcement pressure that has not been publicly disclosed, or whether the operators genuinely concluded a planned operational lifespan. Fourth, no formal individual-operator attribution at the named- Russian-national tier has been publicly issued for Maze administrators, consistent with the broader pattern of absence of similar named-individual-attribution for most contemporary cybercrime clusters covered in this corpus. Only LockBit (Khoroshev), Evil Corp (Yakubets / Turashev), and FIN7 (Dunaev / Hladyr / Kolpakov / Witte) have received named-Russian-national- tier formal attribution.

Maze

Profile

Aliases

Notable Campaigns

Attribution & Reporting

Operational

Techniques Used

Detection Blind Spots

Atomic Test Plan

Tools Used

CVEs Exploited