Maze Ransomware Recovery Services  

Rely on Intelecis to prioritize your data recovery because downtime has a significant negative impact on business performance across all industries. Numerous businesses have benefited from the expertise of our well-equipped Ransomware Team.  

What is Maze?  

A ransomware outbreak called Maze has been affecting businesses since 2019. Despite the fact that Maze was developed by one major gang, it has been utilized for extortion by numerous attackers.

Most Maze operators not only encrypt data, but they also copy it and threaten to disclose it if the ransom is not paid. A Maze ransomware attack is particularly concerning for enterprises because it combines the bad impacts of ransomware (lost data, decreased productivity) with those of a data breach (data breaches, privacy violations). 

How Does Maze Ransomware Work?

The majority of how Maze ransomware was initially spread was through infected email attachments. More current assaults infiltrate a network using several techniques before releasing the ransomware payload. For instance, numerous Remote Desktop Protocol (RDP) assaults utilizing the Maze ransomware have entered a network using stolen or guessed RDP credentials (username and password combinations). Other assaults have been launched once a vulnerable virtual private network (VPN) server was compromised.

Once Maze is inside a network, it takes the following steps:

1. Reconnaissance: In order to ensure that the final activation of the ransomware has the greatest possible impact, Maze examines the network’s weaknesses and locates as many connected machines as it can. Maze, a Windows software that lists all permitted users and computers on a network, among other things, scans Active Directory. Several days after an attacker enters the targeted network, the reconnaissance phase is typically over.
2. Lateral Movement: Maze uses the information it gained during reconnaissance to spread itself across the network, infecting as many devices as possible.
3. Privilege Escalation: As Maze moves laterally, it steals more credentials, enabling it to spread to additional machines. Eventually, it usually acquires administrator credentials, which give it control over the entire network.
4. Persistence: Maze employs a variety of strategies to thwart removal. For instance, it might add backdoors (covert methods of getting around security measures) to the network so it can be reinstalled if it is found and taken down.
5. Attack: At last, Maze starts the procedure for encrypting and leaking data. Once data has been encrypted, Maze shows or sends the victim a ransom note explaining how to pay, decrypt their data, and avoid a data breach.

What happens when a Maze attack is initiated?

Moving data outside of a trusted area without permission is referred to as “exfiltrating.” Maze often exfiltrates data by establishing a connection with an FTP server, moving files and data there, and then encrypting it. The WinSCP and PowerShell tools were utilized by attackers to carry out these tasks.

Exfiltrated data have occasionally been moved to cloud file-sharing platforms rather than straight to an FTP server.