Article
Maze Ransomware: Is Posting Data Counterproductive?
Combating Ransomware
Summary
In 2020, Maze Ransomware began utilizing both encryption and data exfiltration in an attempt to maximize ransom payments, but these tactics may backfire by adding additional incident response costs for victims.
—————————————————————————
Ransomware incidents dominated INFOSEC news in 2019. Penetration methods continued to evolve, attacks became more targeted and ransom demands continued to rise. A major shift in attacker tactics happened in early December when the group behind the Maze ransomware variant started to exfiltrate their victim’s data along with encrypting their files. It was disclosed during active ransom negotiations with the Maze actors that the data that is being exfiltrated from victim networks is being analyzed by Maze actors to determine the price for the ransom demand. The Maze group also created a web page and began to publish data of the victims who refused to pay the ransom.
Maze victims could now be extorted in two different ways, forcing clients to deal with a double-pronged issue – data loss on the one hand and data leakage on the other. This makes restoration from backups a lot less appealing as attackers now are leveraging the data extortion component to apply pressure to victims to pay the ransom demands (even if they have valid backups) to stop further data leakage.
It didn’t take long for a few other ransomware variants, like REvil/Sodinokibi, DopplePaymer, Pysa/Mespinoza, Ako, Clop, Lockbit, Nefilm, Nemty, Netwalker, Ragnar, Sekhmet, Snatch, and Zeppelin, to follow Maze off the bridge and start accessing and exfiltrating their victim’s data as well. All groups believed that having their victim’s data may increase their chances of the ransom being paid but, in reality, this strategy will most likely do quite the opposite.
For every organization that is experiencing a ransomware event, the overall incident response price tag consists of several components:
Initial triage and containment efforts to ensure that the attackers no longer have access to systems and networks Legal assessment to identify all applicable obligations under state and federal laws and regulations Forensic evidence collection and preservation Recovery of data and systems (note: this can occur either by paying the ransom, restoring from backups, or rebuilding systems and data from scratch) Digital forensics investigation
And, if the results of the forensics investigation do not rule out data access or exfiltration by the attacker:
Collection and data mining of compromised data to identify all PII/PCI/PHI records (eDiscovery)
Legal review of results
Notifications of individuals and organizations whose data was compromised;
DarkWeb search and monitoring services to proactively detect if compromised data would get posted on hacker forums or under ground markets.
Prior to December 2019, data access and/or exfiltration for the majority of ransomware incidents were ruled out based upon the results of digital forensics investigations. Because of that, the chances of victims being required to pay hefty fees for eDiscovery and notification services were fairly low. Currently, since more and more ransomware groups have been adopting the tactic of stealing sensitive data, victims have to assume that, as a part of incident response costs, they’ll have to pay for eDiscovery and notification services as well.
At the end of the day, whether to pay or not to pay a ransom is a business decision for every company. By stealing sensitive data, ransomware groups automatically trigger additional mandatory expenses for their victims. This money will be going to companies that specialize in eDiscovery / breach notifications and not the ransomware groups. Even if victims of ransomware attacks have cyber insurance policies, a large portion of their coverage limits will be eaten away by those additional expenses, leaving less money on the table for potential ransom payments.
It might be a good time for ransomware groups to reconsider their strategy and climb back up on that bridge.
Some screen shots of sites where ransomware groups publish victims’ data:
Figure 1 - maze
Figure 2 - Dopplepaymer
Figure 3 - Sodinokibi
Figure 4 - Mespinoza
Back to Blog Posts
Article
FortiBleed Campaign Remains Active
The FBI and Secret Service recently warned that the FortiBleed credential-harvesting campaign remains an active threat targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. The agencies report that attackers continue to scan internet-exposed Fortinet firewalls using previously obtained credentials. This has reinforced assessments made by other security researchers, who have stated that “FortiBleed should be treated as an active access operation, not as a one-time credential leak.”
What’s Notable and Unique
FortiBleed, active since February 2026, begins with widespread reconnaissance to identify internet-facing FortiGate firewalls and SSL-VPN services. Once potential targets are identified, operators attempt to gain initial access through credential stuffing, password spraying, and dictionary attacks using previously compromised credentials.
Following successful access, the attackers deploy the Go-based FortigateSniffer tool on compromised appliances. The tool leverages native FortiOS diagnostic functionality to passively intercept authentication traffic across 24 protocols, enabling the collection of cleartext credentials and password hashes passing through the device.
Successfully recovered credentials are reused to expand access, including Active Directory enumeration, Kerberos validation, SMB authentication, and network share discovery, enabling threat actors to move deeper into the victim environment.
Reporting indicates that initial access brokers (IABs) leveraging the FortiBleed attack chain have facilitated access for downstream ransomware operations, including the INC Ransom/Lynx and Payload ransomware groups. This aligns with Arete’s observations of ransomware groups, including INC, Qilin, and DragonForce, targeting Fortinet FortiGate and VPN infrastructure as an initial access vector.
Remediation
Organizations should restrict internet-facing FortiGate management interfaces, rotate administrative and VPN credentials, review local and privileged accounts, and enforce MFA for remote access. If a potential compromise is detected, organizations should isolate affected systems, conduct threat hunting to determine the scope and identify compromised accounts and devices, and preserve relevant logs and artifacts. Organizations should also report the incident to appropriate authorities and implement targeted eviction measures based on identified threat actor activity.
Analyst Comments
FortiBleed represents an ongoing access-enablement threat, rather than a one-time credential exposure. The campaign’s ability to harvest, validate, and reuse credentials can provide sustained access to victim environments and create opportunities for downstream ransomware activity. Organizations with suspected FortiGate exposure should treat the activity as a potential active compromise and investigate for persistent access, compromised accounts, and lateral movement.
Sources
FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
Article
Threat Actors Exploiting Critical FortiMail Zero-Day Vulnerability
Fortinet has disclosed a critical vulnerability in FortiMail, tracked as CVE-2026-104286, that is currently being exploited as a zero-day in the wild. The flaw, which carries a Critical CVSS score of 9.8, affects the FortiMail management interface and can allow unauthenticated attackers to write arbitrary files to affected systems, potentially leading to unauthorized code execution and full system compromise. Fortinet has confirmed active exploitation and urged customers to implement mitigations immediately while awaiting security updates.
What’s Notable and Unique
The vulnerability stems from improper restriction of file paths combined with improper neutralization of NULL byte characters. An unauthenticated attacker can exploit the flaw via specially crafted HTTP or HTTPS requests to write arbitrary files on the underlying operating system.
Organizations running FortiMail 7.2 can remediate the vulnerability by upgrading to 7.4 or newer. For customers using affected FortiMail 7.4, 7.6, and 8.0 versions, fixes have not yet been released. However, Fortinet has confirmed that the issue will be addressed in the upcoming 7.4.9, 7.6.7, and 8.0.2 releases.
Until the patched versions become available, Fortinet recommends mitigating risk by disabling the Identity-Based Encryption (IBE) feature. As an additional safeguard, administrators should restrict access to the FortiMail management interface, either by removing internet exposure altogether or limiting access to trusted internal networks only. The advisory also includes log entries that administrators can use to identify potentially compromised appliances.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog and directed federal agencies to perform forensic triage and mitigation by October 4th.
Analyst Comments
Impacted organizations should review their FortiMail instances to ensure there are no unauthorized logins, examine device settings, evaluate all configurations as potentially compromised, and carry out the necessary recovery procedures. Defenders should immediately implement Fortinet's recommended mitigations, review systems for IOC matches, and prepare to deploy the forthcoming security updates as soon as they become available. It is strongly advised that all enterprises assess their setups to reduce risk, as protecting publicly accessible management interfaces is a fundamental security best practice.
Sources
Improper limitation of a pathname to a restricted directory
Article
Ransomware Trends & Data Insights: September 2026
The Akira ransomware group re-emerged as the most active ransomware threat observed by Arete in September. Overall activity remained relatively distributed among multiple threat groups, with 29 unique groups observed throughout the month. Alongside Akira, INC Ransom and the relatively new Storm group were among the three most active threat actors observed in September. Several new threat groups also emerged during the month, including Hades Team, Shiba, and Vortex (which is suspected to be part of the cluster of threat actors affiliated with the former BlackFile group).
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In September 2026, the ShinyHunters threat group escalated its extortion activity by publicly targeting both the Clop ransomware group and the FBI. The group claimed to have breached and defaced Clop’s infrastructure, demanding an eight-figure ransom, while separately alleging the theft of sensitive FBI-related data and demanding the retraction of statements made in a prior public advisory. In both incidents, ShinyHunters employed similar pressure tactics, including website defacements, repeated public postings, and threats of data disclosure.
ClickFix attacks remained prevalent in September 2026, with ransomware groups including Qilin, Helix, and The Gentlemen leveraging ClickFix lures to facilitate PowerShell-based payload execution and initial access. The technique continues to evolve, combining social engineering with legitimate tools and services to enable compromise and evade detection.
September 2026 saw continued activity from the former BlackFile extortion ecosystem. BlackFile, a data theft and extortion operation active since at least October 2025, rebranded as Redact in May 2026, and since appears to have broken off into several affiliated brands, including Pink, Helix, Falcon, Cinder, and potentially Vortex. During September, some affiliates publicly disputed these associations and claimed to operate independently. However, the coordinated timing, messaging, and near-identical nature of these statements support the assessment that these groups remain part of a broader interconnected ecosystem operating under shared objectives or coordination.
Article
Attack Patterns in Settra Incidents
Recent Settra ransomware incidents demonstrate a consistent operational pattern involving compromised credentials, VPN access, and the deployment of ransomware executables tailored to victim environments. Researchers have observed Settra naming ransomware executables after the targeted organization's domain while following similar attack sequences across multiple intrusions. Arete has also identified overlapping tactics, techniques, and tools in Settra engagements observed from June to August, including the use of MeshAgent for remote access and Bring Your Own Vulnerable Driver (BYOVD) techniques to weaken endpoint security controls.
What’s Notable and Unique
Settra operators have been observed naming ransomware executables after the victim organization's domain, creating a direct association between the payload and the targeted environment.
Initial access vectors have included targeting exposed VPN infrastructure and the use of compromised credentials, reducing the need for traditional exploitation of vulnerabilities.
Arete observed MeshAgent in multiple Settra engagements, which provides threat actors with a mechanism for remote access and continued activity within compromised environments.
Settra engagements have also included Bring Your Own Vulnerable Driver (BYOVD) activity, which can be used to bypass or impair security controls by abusing legitimate but vulnerable drivers.
Analyst Comments
Recent Settra activity demonstrates how ransomware operators can combine credential-based access, remote management tooling, and security control evasion techniques to establish and maintain access before ransomware deployment. The repeated use of similar tools and operational patterns across incidents provides useful detection opportunities for defenders. Organizations should closely monitor VPN authentication activity, unusual use of compromised credentials, unexpected MeshAgent deployment, ransomware executables with victim-specific naming conventions, and suspicious driver activity associated with attempts to disable or bypass endpoint security controls.
Arete’s MDR practice detects Settra’s full attack chain, with special attention to the staging of BYOVD activity for defense evasion. However, for us to detect it, SentinelOne needs to be fully deployed across an environment. To support organizations with full deployment, Arete offers SentinelOne Deployment Assistance. This service is designed to ensure that SentinelOne is deployed across all eligible endpoints, eliminating coverage gaps that could otherwise expose the organization to ransomware, malware, credential theft, and other advanced threats. Through endpoint discovery, inventory reconciliation, and deployment assistance, Arete helps organizations achieve comprehensive protection and maximize the effectiveness of their SentinelOne investment. Contact clientcares@areteir.com to learn more.
Sources
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM