How do attackers use Maze?

How Maze turns an intrusion into extortion

Maze is not just encryption malware. Its playbook turns a compromise into a negotiation by combining file encryption with data theft, so victims face both business interruption and disclosure pressure. The dual tactic increases leverage because recovery alone does not remove the threat of publication, especially when the stolen data includes regulated, operational, or reputation-sensitive information.

Attackers typically stage the operation in two phases: first they locate and exfiltrate high-value data, then they deploy ransomware to disrupt systems and make the clock visible to the victim. That sequencing matters because it means the extortion value is created before encryption starts, and defenders need to look for theft and staging activity as seriously as they look for the encryption event itself.

The practical implication is that Maze is best understood as an extortion campaign with ransomware as the final pressure step. When organisations only plan for restoration, they miss the earlier signals that the attacker has already taken data and may still be able to pressure the business even if the encrypted systems are recovered.

What attackers try to steal before they encrypt

Maze operators seek sensitive material that increases bargaining power, not just files that are easy to lock. That can include customer records, internal documents, financial information, legal material, credentials, and operational data. The aim is to make publication, not merely downtime, feel like the dominant risk to the victim.

Exfiltration often succeeds because attackers spend time inside the environment before they launch encryption. During that window they can browse shared drives, identify backups, and use legitimate administrative tools or remote access paths to blend in with normal activity. The Ransomware Groups Guide is useful here because Maze sits in the broader double-extortion ecosystem, where affiliates reuse common intrusion and pressure patterns across multiple ransomware crews.

From a defender’s perspective, the most important distinction is between files that were encrypted and data that was stolen. Encryption can be reversed with backups; leaked data cannot be unexfiltrated, so the response must account for disclosure risk as well as service recovery.

What defenders should watch for during a Maze-style attack

Maze campaigns usually leave a mix of operational and forensic signals before the ransom note appears. Large outbound transfers, new archive creation, unusual use of file-transfer tools, repeated access to shared repositories, and remote tooling that does not fit the normal admin pattern all deserve attention. Mass file modification followed by deletion of recovery points is especially concerning because it suggests the attacker is trying to reduce recovery options before detonation.

The response priority is to stop additional exfiltration and contain the systems the attacker can still reach. That usually means segmenting networks, constraining privileged access, and isolating hosts that show both staging behaviour and encryption activity. The CISA cyber threat advisories page is a useful authority for tracking public ransomware guidance and related defensive actions, while MITRE ATT&CK Enterprise Matrix helps map the observed behaviours to credential access, lateral movement, exfiltration, and impact techniques.

Risk and Threat Considerations

Maze-style extortion increases harm by separating the confidentiality loss from the availability loss. Even if encryption is contained, stolen data can keep the incident active because the attacker still controls the disclosure threat, and that can drive legal, regulatory, and customer-notification consequences long after recovery begins.

Failure mechanism: The attacker first gains enough internal access to discover valuable data, then exfiltrates it, then encrypts production systems and recovery points so the victim is pressured on two fronts at once.

Impact: Organisations can face downtime, data exposure, recovery costs, reputational damage, and renewed extortion if the attacker later proves possession of the stolen files.

Practitioner Guidance

What to prioritise: Treat suspected exfiltration as a first-class incident condition, not a prelude to the “real” ransomware event. If outbound volume, archive creation, or remote admin behaviour spikes before encryption, isolate the affected segment before continuing with eradication or recovery.

What to verify: Confirm whether backups are truly offline or otherwise unreachable from the compromised environment, and verify whether the attacker had time to access file shares, backup consoles, or privileged remote tooling. Recovery confidence is much lower if those paths were exposed before encryption.

Practitioner takeaway: The critical decision is not just whether you can restore systems, but whether the attacker had enough time and access to steal data and destroy recovery options first.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?