Maze is used as ransomware for extortion, combining file encryption with data theft to increase pressure on victims. Attackers often exfiltrate sensitive data before encryption and then threaten publication. Defenders should segment networks, restrict privileged access, monitor large outbound transfers, maintain tested offline backups, and detect mass file modification, deletion of recovery points, and unusual remote tooling.
How Maze turns an intrusion into extortion
Maze is not just encryption malware. Its playbook turns a compromise into a negotiation by combining file encryption with data theft, so victims face both business interruption and disclosure pressure. The dual tactic increases leverage because recovery alone does not remove the threat of publication, especially when the stolen data includes regulated, operational, or reputation-sensitive information.
Attackers typically stage the operation in two phases: first they locate and exfiltrate high-value data, then they deploy ransomware to disrupt systems and make the clock visible to the victim. That sequencing matters because it means the extortion value is created before encryption starts, and defenders need to look for theft and staging activity as seriously as they look for the encryption event itself.
The practical implication is that Maze is best understood as an extortion campaign with ransomware as the final pressure step. When organisations only plan for restoration, they miss the earlier signals that the attacker has already taken data and may still be able to pressure the business even if the encrypted systems are recovered.
What attackers try to steal before they encrypt
Maze operators seek sensitive material that increases bargaining power, not just files that are easy to lock. That can include customer records, internal documents, financial information, legal material, credentials, and operational data. The aim is to make publication, not merely downtime, feel like the dominant risk to the victim.
Exfiltration often succeeds because attackers spend time inside the environment before they launch encryption. During that window they can browse shared drives, identify backups, and use legitimate administrative tools or remote access paths to blend in with normal activity. The Ransomware Groups Guide is useful here because Maze sits in the broader double-extortion ecosystem, where affiliates reuse common intrusion and pressure patterns across multiple ransomware crews.
From a defender’s perspective, the most important distinction is between files that were encrypted and data that was stolen. Encryption can be reversed with backups; leaked data cannot be unexfiltrated, so the response must account for disclosure risk as well as service recovery.
What defenders should watch for during a Maze-style attack
Maze campaigns usually leave a mix of operational and forensic signals before the ransom note appears. Large outbound transfers, new archive creation, unusual use of file-transfer tools, repeated access to shared repositories, and remote tooling that does not fit the normal admin pattern all deserve attention. Mass file modification followed by deletion of recovery points is especially concerning because it suggests the attacker is trying to reduce recovery options before detonation.
The response priority is to stop additional exfiltration and contain the systems the attacker can still reach. That usually means segmenting networks, constraining privileged access, and isolating hosts that show both staging behaviour and encryption activity. The CISA cyber threat advisories page is a useful authority for tracking public ransomware guidance and related defensive actions, while MITRE ATT&CK Enterprise Matrix helps map the observed behaviours to credential access, lateral movement, exfiltration, and impact techniques.
Risk and Threat Considerations
Maze-style extortion increases harm by separating the confidentiality loss from the availability loss. Even if encryption is contained, stolen data can keep the incident active because the attacker still controls the disclosure threat, and that can drive legal, regulatory, and customer-notification consequences long after recovery begins.
Failure mechanism: The attacker first gains enough internal access to discover valuable data, then exfiltrates it, then encrypts production systems and recovery points so the victim is pressured on two fronts at once.
Impact: Organisations can face downtime, data exposure, recovery costs, reputational damage, and renewed extortion if the attacker later proves possession of the stolen files.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0010 — Exfiltration | Maze combines data theft with extortion, so exfiltration is central to the attack chain. |
| Recommendation — Map outbound transfer evidence to exfiltration and block the staging path early. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Detecting Maze requires review of unusual admin, file, and transfer activity before encryption. |
| AC-6 — Least Privilege | Maze operators abuse excessive access to reach shares, backups, and high-value data. | |
| CP-9 — System Backup | Maze aims to destroy recovery options, so backup integrity is a core resilience control. | |
| Recommendation — Review and correlate logs for anomalous file, backup, and remote-access activity. Enforce least privilege to limit which accounts can reach sensitive data and recovery systems. Maintain offline, tested backups that cannot be modified from the live environment. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Segmented, continuously verified access reduces attacker reach and blast radius during ransomware intrusion. |
| Recommendation — Apply zero trust principles to constrain lateral movement and protect recovery paths. | ||
Practitioner Guidance
What to prioritise: Treat suspected exfiltration as a first-class incident condition, not a prelude to the “real” ransomware event. If outbound volume, archive creation, or remote admin behaviour spikes before encryption, isolate the affected segment before continuing with eradication or recovery.
What to verify: Confirm whether backups are truly offline or otherwise unreachable from the compromised environment, and verify whether the attacker had time to access file shares, backup consoles, or privileged remote tooling. Recovery confidence is much lower if those paths were exposed before encryption.
Practitioner takeaway: The critical decision is not just whether you can restore systems, but whether the attacker had enough time and access to steal data and destroy recovery options first.