Zscaler Data Protection Recognized as a 2023 Product of the Year by CRN

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Zscaler Coverage for the Maze Ransomware


In this blog, the Zscaler ThreatLabZ team provides details on the Maze ransomware.


On April 18, 2020, Cognizant confirmed a security incident causing service disruptions for some of its clients due to a Maze ransomware attack. The Maze ransomware was first found in May 2019.

What is the issue?

The Maze ransomware, like normal ransomware, will encrypt files in an infected system and then demand a ransom to recover the files. Before encrypting the files, the Maze ransomware will also perform data exfiltration from the infected system. However, one of the important characteristics of the Maze ransomware group is that if the victims do not pay the ransom, they threaten to release the information (including confidential documents) stolen from the infected systems. The Maze ransomware uses different techniques to gain entry to a victim's machine, such as exploits kits, remote desktop connections with weak passwords, and via email attachments.

What systems are impacted?

Since the Maze ransomware binaries are .exe and .dll files, this can impact all machines running the Windows operating system.

What can you do to protect yourself?

We recommend making periodic backups of all important data and keeping those backups isolated off the network. It is equally important to have updated security software and the latest software patches applied to the endpoints. Remote Desktop service access should always be restricted or it should be turned off if not used. As always, avoid opening suspicious emails containing attachments or links that come from any unknown sources. And disable macros in Office programs. Do not enable them unless it is essential to do so.

Zscaler coverage

  • Advanced Threat Protection Signatures
  • Malware Protection
  • Advanced Cloud Sandbox

Details related to these threat signatures can be found in the Zscaler Threat Library.

Our Cloud Sandbox Report for the Maze ransomware executable can be seen in Figure 1.

Zscaler Cloud Sandbox Report for a Maze Ransomware Executable

Figure 1: The Zscaler Cloud Sandbox report for the Maze ransomware

The Zscaler Cloud Sandbox provides proactive coverage against advanced threats, such as ransomware. The Zscaler ThreatLabZ team is also actively monitoring the Maze ransomware family and ensuring coverage for all the latest IOCs associated with the Maze ransomware.

form submtited
Thank you for reading

Was this post useful?

Explore more Zscaler blogs

Technical Analysis of CryptNet Ransomware
Read Post
Trigona ransomware
Technical Analysis of Trigona Ransomware
Read Post
Nevada ransomware
Nevada Ransomware: Yet Another Nokoyawa Variant
Read Post
Ransomware hacker
Nokoyawa Ransomware: Rust or Bust
Read Post
01 / 02
dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.