Skip to content

Maze

Software · ATTACK:enterprise:S0449

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0449",
  "title": "Maze",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0449",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--d9f7383c-95ec-4080-bbce-121c9384457b",
  "external_id": "S0449",
  "domain": "enterprise",
  "created": "2020-05-18T16:17:59.464Z",
  "modified": "2025-04-25T14:44:49.604Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "FireEye Maze May 2020",
      "url": "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html"
    },
    {
      "source_name": "McAfee Maze March 2020",
      "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"
    },
    {
      "source_name": "Sophos Maze VM September 2020",
      "url": "https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006e029e-0714-4f99-befd-53b9fbc7c8c8

FireEye Maze May 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bbdc984-1515-4a8e-a211-2817371fc75e

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1075f27d-8675-4819-b23b-50d390092c95

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20cedb41-1f7b-44df-8d49-5d6fc166c557

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21409e96-7a2f-4109-b23e-1b43005aaaa4

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f3d9b76-bec9-4cee-9a9b-1c42f373ec86

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1564.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cd19d07-822d-4efd-9f8c-e5b329f331a5

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44fab50d-4fb6-4a8a-ab7a-84dcb70443f5

McAfee Maze March 2020 · Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62c1a647-4a39-45b1-8d68-99b19ec12a78

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1568

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a521aa4-d389-4ef4-bd24-442d8af23333

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e4d32b9-923f-46a9-887e-4d4d0687fd1b

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c89cfe5-1a9f-4b2d-82e2-f1638cb13b58

McAfee Maze March 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0449

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5840067-79c4-4965-832c-ebca455cc17c

FireEye Maze May 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a747c7d5-afe9-4120-bb18-f21b5d9bb988

FireEye Maze May 2020 · Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a848dadb-f97f-4ded-a28e-a1c9954804a6

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adbff6cf-1e16-460e-88ed-a0288ab32e68

McAfee Maze March 2020 · Sophos Maze VM September 2020

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0449

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adfee22f-8471-4e82-b85c-21dcbb93ddde

Microsoft Ransomware as a Service

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8ead9c4-0403-4b23-b33f-8ac1c57f8e82

McAfee Maze March 2020 · Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c54e60c1-728d-4211-b309-89f928ae7f0a

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cabbe975-9936-4a9a-8fae-a747b3dc7a9d

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcd5b361-b86b-47c7-8ce8-85918e00a224

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3864ffa-3348-4791-b979-7d8b2e2151cc

McAfee Maze March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1218.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3fa0df1-d388-4e74-b561-acc5094a8e1b

Sophos Maze VM September 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea32ebd2-9827-43ec-a3d3-f0148fee8ed8

McAfee Maze March 2020 · Sophos Maze VM September 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.