Maze
Software · ATTACK:enterprise:S0449
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0449",
"title": "Maze",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0449",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d9f7383c-95ec-4080-bbce-121c9384457b",
"external_id": "S0449",
"domain": "enterprise",
"created": "2020-05-18T16:17:59.464Z",
"modified": "2025-04-25T14:44:49.604Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "FireEye Maze May 2020",
"url": "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html"
},
{
"source_name": "McAfee Maze March 2020",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"
},
{
"source_name": "Sophos Maze VM September 2020",
"url": "https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--006e029e-0714-4f99-befd-53b9fbc7c8c8
FireEye Maze May 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bbdc984-1515-4a8e-a211-2817371fc75e
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1075f27d-8675-4819-b23b-50d390092c95
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20cedb41-1f7b-44df-8d49-5d6fc166c557
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21409e96-7a2f-4109-b23e-1b43005aaaa4
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f3d9b76-bec9-4cee-9a9b-1c42f373ec86
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1564.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cd19d07-822d-4efd-9f8c-e5b329f331a5
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44fab50d-4fb6-4a8a-ab7a-84dcb70443f5
McAfee Maze March 2020 · Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62c1a647-4a39-45b1-8d68-99b19ec12a78
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a521aa4-d389-4ef4-bd24-442d8af23333
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e4d32b9-923f-46a9-887e-4d4d0687fd1b
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c89cfe5-1a9f-4b2d-82e2-f1638cb13b58
McAfee Maze March 2020ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0449
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5840067-79c4-4965-832c-ebca455cc17c
FireEye Maze May 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a747c7d5-afe9-4120-bb18-f21b5d9bb988
FireEye Maze May 2020 · Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a848dadb-f97f-4ded-a28e-a1c9954804a6
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adbff6cf-1e16-460e-88ed-a0288ab32e68
McAfee Maze March 2020 · Sophos Maze VM September 2020ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0449
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adfee22f-8471-4e82-b85c-21dcbb93ddde
Microsoft Ransomware as a ServiceATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8ead9c4-0403-4b23-b33f-8ac1c57f8e82
McAfee Maze March 2020 · Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c54e60c1-728d-4211-b309-89f928ae7f0a
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cabbe975-9936-4a9a-8fae-a747b3dc7a9d
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcd5b361-b86b-47c7-8ce8-85918e00a224
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3864ffa-3348-4791-b979-7d8b2e2151cc
McAfee Maze March 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3fa0df1-d388-4e74-b561-acc5094a8e1b
Sophos Maze VM September 2020ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea32ebd2-9827-43ec-a3d3-f0148fee8ed8
McAfee Maze March 2020 · Sophos Maze VM September 2020