Threat Brief: Maze Ransomware
Summary: Palo Alto Networks reports an uptick in Maze ransomware samples across multiple industries this calendar year; Maze, a variant of ChaCha ransomware first observed in May 2019, has targeted organizations across North America, South America, Europe, Asia, and Australia. It is typically distributed through emails with weaponized Word or Excel attachments, and has also spread via the Spelevo Exploit Kit using Flash Player vulnerabilities CVE-2018-15982 and CVE-2018-4878, plus CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer).
Key Takeaway: Before encrypting data, Maze operators may exfiltrate files for further coercion, including public exposure, and they pay special attention to cloud backups on compromised networks, downloading backup data to an actor-controlled server if they obtain login credentials.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-15982CVE-2018-4878CVE-2018-8174CVE-2019-11510
- Related
- CVE-2018-15982: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021