{"id":3847,"date":"2020-09-14T11:50:26","date_gmt":"2020-09-14T16:50:26","guid":{"rendered":"https:\/\/www.stratospherenetworks.com\/blog\/?p=3847"},"modified":"2020-09-14T11:50:26","modified_gmt":"2020-09-14T16:50:26","slug":"5-things-you-should-know-about-maze-ransomware","status":"publish","type":"post","link":"https:\/\/www.stratospherenetworks.com\/blog\/5-things-you-should-know-about-maze-ransomware\/","title":{"rendered":"5 Things You Should Know About Maze Ransomware"},"content":{"rendered":"

\"AAs people around the world continue to grapple with the challenges presented by the COVID-19 pandemic<\/a>, business leaders must also worry about the continued spread of another type of damaging infection: Ransomware<\/a>.<\/p>\n

You\u2019ve probably already heard about this type of malware, which infects your network and encrypts your files, according to the U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA)<\/a>. After that, the cybercriminals behind the attack will demand that you pay a ransom in exchange for the decryption key. These kinds of attacks have become increasingly costly and common in recent years.<\/p>\n

The Rising Prevalence and Price of Ransomware Attacks<\/h2>\n

Ransomware was already \u201cthe most pervasive cyber threat since 2005\u201d before the pandemic, according to the CSO article \u201cThe history of ransomware<\/a>.\u201d Now, in efforts to take advantage of the chaos caused by the novel coronavirus, malicious actors have launched various COVID-19-themed schemes<\/a>, including ransomware attacks. In the first half of 2020, ransomware-related incidents accounted for 41 percent of reported cyber insurance claims, according to a report from Coalition<\/a>.<\/p>\n

Hackers have also gotten more demanding<\/a> recently: During the first quarter of 2020, the average ransom payment went up to $111,605, an 11 percent increase compared to the fourth quarter of 2019, Coveware reported<\/a>. The most common attack vectors were phishing messages<\/a>, software vulnerabilities and Remote Desktop Protocol (RDP) compromise.<\/p>\n

Up until recently, backing up your data<\/a> regularly offered a way to restore your systems without giving in to the criminals\u2019 demands in the event of a ransomware attack. However, a new variant of this species of malware called Maze has rendered backups ineffective as a preventive measure. Here\u2019s everything you should know about this type of ransomware and how you can fight it.<\/p>\n

The Emergence of Maze and Key Facts to Know About It<\/h2>\n

Maze first popped up in 2019 as a variant of ChaCha ransomware, according to the Malwarebytes Labs blog post \u201cMaze: the ransomware that introduced an extra twist<\/a>.\u201d Since then, it\u2019s made headlines due to its unique strategy for getting victims to pay up, even if they have reliable backups.<\/p>\n

Here are a few key things you should know about Maze ransomware to craft and maintain a comprehensive cybersecurity strategy for your organization.<\/p>\n

1. Maze exfiltrates data, and the criminals behind the attack will threaten to leak sensitive info if you don\u2019t pay the ransom. <\/strong>This strategy means that restoring your systems from backups won\u2019t get you out of trouble, Malwarebytes explains. For example, the first known victim of this kind of malware, a security services company in California, had 700MB of their data released after they didn\u2019t hand over the money the hackers demanded. That means victims face the choice of paying the ransom or dealing with a data breach.<\/p>\n

2. Other kinds of ransomware have followed Maze\u2019s example. <\/strong>Sodinokibi, Clop and Nemty are just some of the other variants that have picked up this new spin on extortion, according to the McAfee Labs blog entry \u201cRansomware Maze<\/a>.\u201d<\/p>\n

3. These are not empty threats.<\/strong> The cybercriminals who leverage Maze have a dedicated website where they list their victims and allow visitors to download the stolen data. This ensures that the data breaches get press coverage, according to the Tripwire article \u201cMaze Ransomware \u2013 What You Need to Know<\/a>.\u201d<\/p>\n

4. The main ways that malicious actors infect their victims\u2019 IT environments with Maze are RDP brute force attacks and email spam\/phishing campaigns, according to Malwarebytes. <\/strong>Other methods include unpatched vulnerabilities, Tripwire states.<\/p>\n

5. Because backups won\u2019t save you, it\u2019s important to act before hackers try to infect your network. <\/strong>There are fortunately numerous steps you can take to proactively protect your business from Maze and other types of cybersecurity threats:<\/p>\n