Article
Maze Ransomware: Is Posting Data Counterproductive?
Combating Ransomware
Summary
In 2020, Maze Ransomware began utilizing both encryption and data exfiltration in an attempt to maximize ransom payments, but these tactics may backfire by adding additional incident response costs for victims.
—————————————————————————
Ransomware incidents dominated INFOSEC news in 2019. Penetration methods continued to evolve, attacks became more targeted and ransom demands continued to rise. A major shift in attacker tactics happened in early December when the group behind the Maze ransomware variant started to exfiltrate their victim’s data along with encrypting their files. It was disclosed during active ransom negotiations with the Maze actors that the data that is being exfiltrated from victim networks is being analyzed by Maze actors to determine the price for the ransom demand. The Maze group also created a web page and began to publish data of the victims who refused to pay the ransom.
Maze victims could now be extorted in two different ways, forcing clients to deal with a double-pronged issue – data loss on the one hand and data leakage on the other. This makes restoration from backups a lot less appealing as attackers now are leveraging the data extortion component to apply pressure to victims to pay the ransom demands (even if they have valid backups) to stop further data leakage.
It didn’t take long for a few other ransomware variants, like REvil/Sodinokibi, DopplePaymer, Pysa/Mespinoza, Ako, Clop, Lockbit, Nefilm, Nemty, Netwalker, Ragnar, Sekhmet, Snatch, and Zeppelin, to follow Maze off the bridge and start accessing and exfiltrating their victim’s data as well. All groups believed that having their victim’s data may increase their chances of the ransom being paid but, in reality, this strategy will most likely do quite the opposite.
For every organization that is experiencing a ransomware event, the overall incident response price tag consists of several components:
Initial triage and containment efforts to ensure that the attackers no longer have access to systems and networks Legal assessment to identify all applicable obligations under state and federal laws and regulations Forensic evidence collection and preservation Recovery of data and systems (note: this can occur either by paying the ransom, restoring from backups, or rebuilding systems and data from scratch) Digital forensics investigation
And, if the results of the forensics investigation do not rule out data access or exfiltration by the attacker:
Collection and data mining of compromised data to identify all PII/PCI/PHI records (eDiscovery)
Legal review of results
Notifications of individuals and organizations whose data was compromised;
DarkWeb search and monitoring services to proactively detect if compromised data would get posted on hacker forums or under ground markets.
Prior to December 2019, data access and/or exfiltration for the majority of ransomware incidents were ruled out based upon the results of digital forensics investigations. Because of that, the chances of victims being required to pay hefty fees for eDiscovery and notification services were fairly low. Currently, since more and more ransomware groups have been adopting the tactic of stealing sensitive data, victims have to assume that, as a part of incident response costs, they’ll have to pay for eDiscovery and notification services as well.
At the end of the day, whether to pay or not to pay a ransom is a business decision for every company. By stealing sensitive data, ransomware groups automatically trigger additional mandatory expenses for their victims. This money will be going to companies that specialize in eDiscovery / breach notifications and not the ransomware groups. Even if victims of ransomware attacks have cyber insurance policies, a large portion of their coverage limits will be eaten away by those additional expenses, leaving less money on the table for potential ransom payments.
It might be a good time for ransomware groups to reconsider their strategy and climb back up on that bridge.
Some screen shots of sites where ransomware groups publish victims’ data:
Figure 1 - maze
Figure 2 - Dopplepaymer
Figure 3 - Sodinokibi
Figure 4 - Mespinoza
Back to Blog Posts
Article
Arete's 2026 Q1 Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
CMS Vulnerability Leads to ClickFix Campaign
Threat actors compromised at least 700 education and technology websites in a recent ClickFix campaign by exploiting a critical SQL injection flaw (CVE-2026-26980) in the Ghost content management system (CMS). Adversaries combined the vulnerability with the ClickFix social engineering tactic to steal admin keys and inject a malicious JavaScript that delivers a fake Cloudflare or CAPTCHA verification pop-up, tricking victims into copying and pasting a malicious command into their systems.
What’s Notable and Unique
Rather than targeting the end user first, this campaign is unique in its initial exploitation of the system, followed by social engineering attempts. This hybrid attack style is likely being leveraged to bypass traditional defenses.
This recent campaign also highlights how trusted web properties can be weaponized at scale and coupled with unpatched CMS vulnerabilities. Rather than using the CMS compromise to perpetrate a single attack, threat actors turned it into a supply-chain attack that ultimately affected over 700 trusted websites.
Analyst Comments
As network defenders and their tools enhance threat detection capabilities, adversaries increasingly seek methods to bypass these defenses. By combining vulnerability exploitation, social engineering techniques, and staging for ancillary attacks, this campaign successfully bypassed traditional defenses and inflicted significant impact. Defending against hybrid cyberattacks requires comprehensive security controls beyond simply patching vulnerabilities. Organizations should focus on limiting movement within the environment, detecting abuse of trusted applications, and preventing end-user manipulation.
Sources
700+ education and tech websites hijacked in huge ClickFix malware campaign
Under the engineering hood: Why Malwarebytes chose WordPress as its CMS
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware
Article
Threat Actors Leverage Fake JPEG Files for Initial Access
In a recent campaign, researchers observed threat actors using fake JPEG image files as a delivery mechanism to initiate the deployment of additional malicious components. The false JPEG files are typically distributed via phishing emails or other social engineering-based lures, and are actually PowerShell-based malware that deploys a trojanized version of ConnectWise ScreenConnect to establish and maintain persistence in the compromised environment.
What’s Notable and Unique
This campaign leverages JPEG images as the initial lure, where the images are not merely decoys but part of the infection workflow. Victims are typically led to download or open an image that triggers hidden execution logic or redirects them to a payload-delivery sequence that initiates later stages of the intrusion chain.
The attack chain is designed to blend into legitimate environments, making detection more difficult. Execution typically relies on scripted or native Windows components, often including PowerShell or other living-off-the-land binaries, enabling fileless or near-fileless execution and reducing forensic artifacts on disk.
The multistage design ensures that the initial JPEG does not directly contain the full payload but instead triggers retrieval or decryption steps that progressively assemble the final malicious components in memory.
Analyst Comments
This campaign illustrates how threat actors continue to blur the line between legitimate file handling and malicious execution chains, indicating potential overlap with remote management or administrative tooling. The use of JPEG-based staging combined with script-based execution reflects a broader evolution toward a stealth-first intrusion design, in which file formats serve as triggers rather than payload containers.
Sources
OPERATION SILENTCANVAS : JPEG BASED MULTISTAGE POWERSHELL INTRUSION
Podcast
Cyber Risk and Insurance for Law Firms
In this episode of Bytes of Insight, host Vinny Sakore is joined by Laura Zaroski, Managing Director of the Law Firms Group at Gallagher, as they discuss the evolution of cyber risk for law firms. Tune in for firsthand insights on how to select the right cyber policy, the incident response process, and the nuances of ransom payments and sensitive data.