Maze ransomware is shutting down its cybercrime operation

guest · Oct 29, 2020

Maze ransomware is shutting down its cybercrime operation
October 29, 2020
https://www.bleepingcomputer.com/ne...re-is-shutting-down-its-cybercrime-operation/

The Maze cybercrime gang is shutting down its operations after rising to become one of the most prominent players performing ransomware attacks.

The Maze ransomware began operating in May 2019 but became more active in November.
That's when the media-savvy operation revolutionized ransomware attacks by introducing a double-extortion tactic.
Maze continued to evolve ransomware operations by forming a ransomware cartel with Ragnar Locker and LockBit, to share information and tactics.
Click to expand...

Maze started to shut down six weeks ago
Early last month, BleepingComputer began hearing rumors that Maze was getting ready to shut down their ransomware operation in a similar manner as GandCrab did in 2019.

The closing of operations was later confirmed after BleepingComputer was contacted by a threat actor involved in the Barnes and Noble ransomware attack.
As part of our conversation, BleepingComputer was told that Maze was in the process of shutting down its operation, had stopped encrypting new victims in September 2020, and are trying to squeeze the last ransom payments from victims.

When BleepingComputer reached out to Maze to confirm if they were shutting down, we were told, "You should wait for the press release."
Click to expand...

BleepingComputer has reached out to Maze to ask if they will release their keys when they shut down their operation but have not heard back.
Click to expand...

Osaban · Oct 29, 2020

They probably made enough money and need to change their name.

guest · Nov 2, 2020

Maze ransomware shuts down operations, denies creating cartel
November 2, 2020
https://www.bleepingcomputer.com/ne...shuts-down-operations-denies-creating-cartel/

Last week, BleepingComputer reported that Maze had stopped encrypting new victims since the middle of September, cleaned up their data leak site, and was extorting their final victims.

Today, Maze released a press release titled "The Project is closed," where they state that they are closed and any other ransomware operation that uses its name is a scam.

"Maze Team Project is announcing it is officially closed.
All the links to out project, using of our brand, our work methods should be considered to be a scam.

We never had partners or official successors. Our specialists do not works with any other software. Nobody and never will be able to host new partners at our news website. The Maze cartel was never exists and is not existing now. It can be found only inside the heads of the journalists who wrote about it."
BleepingComputer has asked Maze if they would be willing to release the master decryption keys when they close their support site like was done with Crysis, TeslaCrypt, and Shade. We have not received a response to this question.
Click to expand...

Maze denies having formed a cartel
In June 2020, it was noticed that the Maze group had added information about a victim from a different ransomware operation called LockBit.
To learn more about this collaboration between Maze and LockBit, BleepingComputer contacted the ransomware operators and was told that they are now collaborating with other groups to share information and experiences.

"In a few days another group will emerge on our news website, we all see in this cooperation the way leading to mutual beneficial outcome, for both actor groups and companies."

In today's post, Maze states that this is all a fabrication, and that 'Maze Cartel only existed inside the heads of journalists who wrote about it.'
To what extent this "Maze Cartel" existed and the collaboration between its members is unknown.
Click to expand...

guest · Nov 4, 2020

As Maze retires, clients turn to Sekhmet ransomware spin-off Egregor
The ransomware’s ‘retirement’ has left a hole that Egregor operators may capitalize on
November 4, 2020
https://www.zdnet.com/article/as-ma...-turn-to-sekhmet-ransomware-spin-off-egregor/

As the developers of the Maze ransomware announce their exit from the malware scene, clients are now thought to be turning to Egregor as a substitute.

The Maze group has been a devastating force for companies that have fallen victim to the cybercriminals over the past year.
Maze would attack a corporate resource, encrypt files or just focus on stealing proprietary data, and then demanded payment -- often reaching six figures -- in cryptocurrency.
Click to expand...

Malwarebytes noted a drop-off in infections since August and so say that withdrawal from the scene is "not really" an unexpected move.

However, that doesn't mean that previous customers of Maze would also quit the market, and the researchers suspect that "many of their affiliates have moved to a new family" known as Egregor, a spin-off of Ransom.Sekhmet.
Egregor uses a range of anti-obfuscation techniques and payload packing to avoid analysis. The ransomware's functionality is considered to be similar to Sekhmet.
Click to expand...

While affiliates transition to Egregor, Malwarebytes warns that this may not be the last time we see Maze as an active threat.

"History has shown us that when a crime group decides to close its doors, it's rarely because the criminals have seen the error of their ways and it's more often due to a new, more powerful threat that the threat actors would prefer to use," the researchers note. "So, with businesses now being targeted with the next ransomware and no sign of hope for victims of the past we see no reason to be particularly happy about this."
Click to expand...

Log in or Sign up

Maze ransomware is shutting down its cybercrime operation

guest Guest

Osaban Registered Member

guest Guest

guest Guest

Log in or Sign up

Maze ransomware is shutting down its cybercrime operation

guest Guest

Osaban Registered Member

guest Guest

guest Guest

Useful Searches