What We Do
How We Do
Get Started
Security advisories

Maze Ransomware

April 21, 2020 | 1 MIN READ

Speak With A Security Expert Now



Ransomware campaigns are continuing through the COVID-19 period, with notable activity from the Maze ransomware group. The Maze ransomware actors use a variety of techniques to gain access to organizations; once admin privileges are achieved the groups exfiltrates information and deploy the maze ransomware. The potential damage of ransomware is even higher than during standard periods as many businesses cannot switch to manual operations due to the COVID-19 move to remote workforces.

Maze first emerged in late May 2019 and was the first major ransomware group to announce data theft and exposure in cases where the ransom was not paid. Organizations are recommended to take proactive steps to prevent the delivery and spread of ransomware on corporate networks and assets. 

What we’re doing about it

What you should do about it

Additional information

On April 18th, 2020, the IT services firm Cognizant was infected with Maze ransomware [2]. Cognizant employs nearly 300,000 people and has clients in over eighty different countries. At this time, it is unclear what ransom has been demanded or whether any information was ex-filtrated prior to ransomware deployment. 

Maze ransomware has historically seen success with various victims ranging from law firms to oil companies. Part of this success is likely due to the varying delivery methods used by the Maze ransomware actors. Past Maze infections have been traced back to exploit kits, unsecured remote desktop connections, impersonation emails and compromised email accounts via malicious Word documents. 

For additional technical details relating to Maze ransomware, see the report Ransomware Maze by Alexandre Mundo [3]. 


[1]  https://support.office.com/en-us/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6

[2] https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/

[3] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/

View Most Recent Advisories