It is being reported by ZDNet that the Maze ransomware group has attacked two companies that, apparently, refused to pay the requested ransom, so Maze, as it promises, recently released approximately 76GB combined of the companies’ data on the Internet.
True to its threat, once Maze is able to infiltrate a company’s system, it exfiltrates data without the company’s knowledge, then encrypts the data and drops a ransomware note. If the company elects to migrate to its back-up system and refuses to pay the ransom, Maze notifies the company that it has already exfiltrated data and that if the company does not pay a ransom for a certificate of destruction, it will release the data online.
So far, based on our research, Maze has, in an oxymoronic kind of way, been men of their word, as we have not seen any reports that they have reneged on their promise to destroy the data. Criminals who will keep their word! It is a difficult concept to wrap one’s brain around.
Of course, it does make sense, because if they were to accept Bitcoin for a certificate of destruction and then share the data with other criminals or post it online, the word would get out quickly and no companies would ever pay for a certificate of destruction, as they would have no confidence that the criminals would keep their promise. This would destroy Maze’s entire business plan and their flow of income. Ransomware is here to stay and the attacks are becoming more and more sophisticated.