fbi seal

FBI Warns U.S. Companies About Recent Scourge of “Maze” Ransomware Attacks

The advisory warned businesses about cyber attacks featuring cryptocurrency sites and spam campaigns impersonating government agencies.

In a recent advisory to private companies across the U.S., the FBI warned businesses about a series of cyber attacks using “Maze” ransomware, which began hitting American organizations in November.

According to CyberScoop, which obtained a copy of the alert sent to businesses in late December, the FBI described a recent scourge of ransomware attacks in which the hacker, sometimes acting as a government agency, stole data from companies and encrypted it to further extort the business.

“From its initial observation, Maze used multiple methods for intrusion, including the creation of malicious look-a-like cryptocurrency sites and malspam campaigns impersonating government agencies and well-known security vendors,” the advisory reads, according to CyberScoop.

The advisory also cited a late November attack in which hackers using Maze threatened to release confidential and sensitive files from an American victim in a move to extort the company for ransom.

Hackers using Maze software were behind the ransomware attack that targeted the city government of Pensacola, Florida in December shortly after a shooter killed three sailors at the Naval Air Station Pensacola.

The actors behind the attack released 2GB of files that were allegedly stolen from the government in an effort to pressure officials to pay the ransom, according to BleepingComputer. Hackers have demanded a $1 million payment to release the data.

Brett Callow, an analyst at cybersecurity firm Emsisoft, told StateScoop that the group is using the data as additional leverage to extort payment.

“Whether the city pays or doesn’t pay, the end result is the exactly same: their data is in the hands of cybercriminals,” Callow said. “Were the city to pay, it would simply have the criminals’ word that the data wouldn’t be released or that they wouldn’t attempt to extort money for a second time.”

Cybersecurity experts say that the Maze trend is an indication of attacks to come.

“We expect to see an increasing trend of threat actors stealing sensitive data from victim organizations before encrypting the data in the victim environments,” Charles Carmakal, senior vice president at Mandiant, told CyberScoop.

Carmakal added: “Organizations may feel more coerced to pay the threat actors because they may feel it’s the best option to prevent the disclosure of sensitive information."

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Tradeshow Work Can Be Fun

    While at ISC West last week, I ran into numerous friends and associates all of which was a pleasant experience. The first question always seemed to be, “How many does this make for you?” Read Now

    • Industry Events
    • ISC West
  • New Report Says 1 in 5 SMBs Would Be Forced to Shutter After Successful Cyberattack

    Small and medium-sized businesses (SMBs) play a crucial role in the U.S. economy, making up 99.9% of all businesses and contributing to half of the nation's GDP. However, these vital economic growth drivers face an escalating threat—cyberattacks that could put them out of business. Read Now

  • The Yellow Brick Road

    The road to and throughout Wednesday's and Thursday's ISC West was crowded but it was amazing. Read Now

    • Industry Events
    • ISC West
  • An Inside Look From Napco at ISC West

    Get a look into the excitement at ISC West 2025 from Napco. Hear from some of their top-tech executives live from the show floor. Read Now

    • Industry Events
    • ISC West
  • Upping the Ante

    I am not a betting man in terms of cards, dice, blackjack or that wheel with the black marble racing around the circumference of a spinning wheel, but I would bet on the success of ISC West this year. Read Now

    • Industry Events
    • ISC West

New Products

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection.

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.