The creators of Maze Ransomware have added a new wrinkle to the typical hacker’s MO. Instead of quietly infecting and requesting ransom from victims, the so-called Maze team is publicly exposing victims by displaying real files exfiltrated from their hacked servers.
This tactic could be a disaster for crypto companies that may have put private keys or other important financial data into their private archives, should they be breached.
“Represented here companies don’t wish to cooperate with us, and trying to hide our successful attack on their resources. Wait for their databases and private papers here,” write the hackers on their public website, mazenews.top. “Follow the news!”
Companies that have already been hit by the group include a grocery chain, Busch’s Inc., in Ann Arbor, Mich., and a lawn and garden company, Massey Services, in Florida. We’ve reached out to the alleged Maze victims; many have already made public information about the hacks on their websites.
Another group, called REvil, promises to release for free or sell vital company information to competitors if its ransom is not paid. The hackers wrote:
Each attack includes a copy of private, commercial information. In case they refuse to pay, the data will either be sold to competitors or posted on open sources. We’re interested in seeing how the GDPR [General Data Protection Regulation] authorities react. If they do not want to pay us they can pay 10 times more to the government. No problem.
Translated by CoinDesk
“For years, ransomware developers and affiliates have been telling victims that they must pay the ransom or stolen data would be publicly released,” said Lawrence Abrams, ransomware researcher at BleepingComputer. “While it has been a well-known secret that ransomware actors snoop through victim’s data, and in many cases steal it before the data [are] encrypted, they never actually carried out their threats of releasing it.”
“This is especially ghastly news for companies that may…