In November 2019, the Maze ransomware operators published data stolen from Allied Universal, a security services company, on a hacker forum. The data dump was a threat: pay the ransom or more data gets published. Allied Universal had not paid. Maze's operators followed through. It was not the first time ransomware had been combined with data theft, but it was the moment the tactic became visible enough to be adopted across the ransomware industry. Within twelve months, every major ransomware group was operating a data leak site and threatening to publish stolen data alongside their encryption demand.

Maze called this "double extortion" and operated it with a degree of professionalism that was unusual even in the increasingly organized criminal ransomware market. The group maintained a public-facing website, issued press releases, gave interviews to security researchers and journalists, and ran their data leak site with the operational consistency of a media company. When they announced their retirement in November 2020, they did so through a formal statement. Whatever else they were, they were not careless.

The Technical Foundation

Maze's ransomware was technically competent without being novel. It used a combination of ChaCha20 for file encryption and RSA-2048 for key protection - the same basic architecture as most professional ransomware. Its initial access vectors varied: the group used phishing emails with malicious attachments, exploitation of public-facing vulnerabilities (Citrix ADC, Pulse Secure VPN, RDP brute force), and purchase of access from initial access brokers. Once inside a network, Maze operators conducted extensive reconnaissance before deploying the ransomware - mapping the network, identifying domain controllers and backup systems, exfiltrating valuable data, and maximizing their foothold before encryption.

The data exfiltration phase was what differentiated Maze from prior ransomware operations. Before encrypting files, operators would identify and exfiltrate valuable data: financial records, personnel files, client data, intellectual property, legal documents. This required more time and operational sophistication than simply deploying ransomware immediately, but it created a second leverage point: even organizations with good backups who could restore encrypted systems without paying now faced exposure of sensitive data.

The "double extortion" model addressed the primary ransomware defense of the era. Security awareness had been improving: more organizations had backups, more had tested recovery procedures, and the response to "I have encrypted your files" increasingly was "we'll restore from backup." Maze's response to "we'll restore from backup" was "we also have your files, and we'll publish them." This created leverage where none had previously existed.

[INFO]
Maze claimed, in communications with security researchers, that they had identified and tested the double extortion model through observation of targets' responses to ransomware. Organizations that paid quickly were those without adequate backup coverage; organizations with good backups often declined to pay. Adding a data exposure threat converted the population of "won't pay because they have backups" into "might pay to prevent exposure." From an economic perspective, it was a straightforward expansion of the leverage available against any given target.

The Maze Cartel

In June 2020, Maze announced that it had formed a "cartel" with two other ransomware operations: Lockbit and Ragnar Locker. The cartel arrangement allowed the groups to share their data leak site infrastructure and, reportedly, to share initial access. When Lockbit couldn't extract data from a target, Maze's operators might assist, and vice versa.

The cartel concept was unusual in ransomware circles, where groups operated independently and guarded their techniques and infrastructure. The announcement may have been partly marketing - creating the impression of a sophisticated organized criminal enterprise to increase negotiating leverage with victims. Whether the operational cooperation was as extensive as implied is unclear. But the concept influenced subsequent thinking about ransomware group structure, and the "cartel" branding was adopted by other groups.

Maze's public communications were a distinguishing feature. The group maintained a Maze News website where they posted press releases about their operations, announced new victims, and published stolen data. When security researcher Brian Krebs wrote about them, they responded. When they wanted to release information about a victim's decision not to pay, they coordinated publication timing. This media engagement was deliberate - it amplified the threat to future victims who read news coverage of Maze attacks and understood that non-payment meant public exposure.

Notable Attacks

Cognizant, the IT services giant, disclosed a Maze attack in April 2020. The breach affected Cognizant's internal network and potentially the networks of clients whose systems Cognizant managed. The estimated cost was $50-70 million in lost revenue and remediation expenses. The attack illustrated a vector that became increasingly prominent: attacking managed service providers (MSPs) and IT service firms to gain access to their clients' networks.

Xerox was hit in June 2020. Maze published Xerox employee data after the company declined to pay. Canon was attacked in August 2020, with Maze publishing proof that included 10 TB of data and images from Canon's image.canon cloud service that the attack had apparently affected. LG Electronics was listed on Maze's site in June 2020 alongside what was claimed to be source code from LG's business division.

The targets were consistent with Maze's financial focus: large enterprises with revenue sufficient to pay significant ransoms, operating in sectors (technology, services, manufacturing) where operational disruption and data exposure created maximum leverage. Healthcare organizations were initially excluded from targeting - a carve-out that the operators claimed for ethical reasons and that was also strategically rational, since healthcare attacks generated disproportionate law enforcement attention.

[WARNING]
The healthcare exclusion did not hold industry-wide. Ryuk and subsequently REvil, Conti, and others attacked hospitals, healthcare systems, and medical facilities throughout 2020-2022, including during the COVID-19 pandemic. The attack on Universal Health Services in September 2020, attributed to Ryuk, took hospital IT systems offline across 400 facilities. A ransomware attack on Düsseldorf University Hospital in September 2020 caused a patient to be redirected to another hospital and was investigated as potentially contributing to her death - the first documented fatality potentially linked to a ransomware attack. The healthcare carve-out that Maze maintained was not representative of the industry.

The Retirement

Maze announced its retirement in a November 2020 statement that was, consistent with their media approach, significantly more articulate and self-aware than typical criminal group announcements. The statement claimed the group had never been a "cartel" (contradicting their own June announcement), said it had fulfilled its purpose, and described itself as a "project" that had run its course. They did not identify themselves or suggest they would face legal consequences.

The retirement was probably a rebranding. Egregor ransomware appeared in September 2020, two months before Maze's retirement, used the same code base, and replicated Maze's operational style including the media presence and data leak site. The overlap suggested that Maze's operators had rebranded rather than genuinely retired. Egregor was disrupted in February 2021 when Ukrainian authorities arrested multiple members in a joint operation with French law enforcement.

Legacy: Every Group Copied It

The double extortion model's legacy is visible in every major ransomware operation active in 2021 and beyond. REvil (Sodinokibi) had been operating without data leak pressure before 2020; it added a leak site in early 2020. DarkSide, which conducted the Colonial Pipeline attack, operated a data leak site as a primary feature from its founding in August 2020. LockBit, Conti, BlackCat/ALPHV, Hive, Cl0p - every major ransomware operation that followed Maze's 2019 innovation operated with both encryption and data exposure as leverage.

Some groups took the evolution further: "triple extortion" added DDoS attacks or direct contact with the victim's customers and regulators to the toolkit. Cl0p's MOVEit campaign represented a further evolution: pure data extortion with no encryption at all, relying entirely on the data exposure threat. The encryption half of "double extortion" turned out to be optional - what mattered was having data that the victim needed to keep private.

The Maze group's press-release approach also influenced how ransomware groups communicated. The professionalization of ransomware communications - clear demands, payment timelines, negotiation infrastructure, customer service for victims trying to decrypt their files - was partly a response to market pressure (victims won't pay if the process is chaotic) and partly a reflection of the Maze model that demonstrated professional presentation increased both payment rates and media coverage.

[IOC]
Maze ransomware indicators: Encrypted file extension .maze appended (later variants used random extensions). Ransom note: DECRYPT-FILES.html in each affected directory. Process: Maze creates a service named "MAZE" for persistence. Network: HTTPS callbacks to C2 infrastructure (varies by campaign). Pre-encryption data staging: large outbound transfers to cloud storage (Mega, anonymous FTP) or attacker-controlled infrastructure. File system: maze.exe or similar in %TEMP% or %APPDATA%. Initial access: Citrix ADC CVE-2019-19781 exploitation, RDP with compromised credentials, email phishing with Word/Excel macros. Detection: monitor for large-scale file rename/modify operations and abnormal outbound data transfers before encryption begins.