What is Maze Ransomware?

Maze Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Mid-size enterprises; pioneer of data-exfiltration ransomware

Source Attribution

Origin: MITRE
Source: MITRE ATT&CK · news advisories
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: MITRE ATT&CK · news advisories · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2019-05 discovered Maze first observed
2020-05 updated Operators announced retirement

Quick Answer

Maze operators exfiltrate sensitive data before encryption and post samples on a public leak site to pressure payment.

Definition

Maze is widely credited as the first modern ransomware family to publicly leak stolen data, launching the double-extortion model in 2019/2020.

Overview

Maze is widely credited as the first modern ransomware family to publicly leak stolen data, launching the double-extortion model in 2019/2020.

Behavior

First public data-leak practice
End-of-life announced May 2020
RaaS operation with affiliates

First Seen

2019-05

Target

Mid-size enterprises; pioneer of data-exfiltration ransomware

Techniques: T1486, T1567, T1490
Campaigns: n/a
Related CVEs: n/a

Malware Intelligence

Family: Maze Ransomware

Aliases: Maze, ChaCha

Techniques: T1486, T1567, T1490

Targets: Mid-size enterprises; pioneer of data-exfiltration ransomware

Behavior:

First public data-leak practice
End-of-life announced May 2020
RaaS operation with affiliates

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Maze Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Maze Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.