TA2101

Also known as: DEV-0216, GOLD VILLAGE, Gold Village, Hive0104, Maze Team, Storm-0216, TA2101, TUNNEL SPIDER, TWISTED SPIDER, Tunnel Spider, Twisted Spider, UNC2198, White Labyrinth

Proofpoint researchers detected campaigns from a relatively new actor, tracked internally as TA2101, targeting German companies and organizations to deliver and install backdoor malware. The actor initiated their campaigns impersonating the Bundeszentralamt fur Steuern, the German Federal Ministry of Finance, with lookalike domains, verbiage, and stolen branding in the emails. For their campaigns in Germany, the actor chose Cobalt Strike, a commercially licensed software tool that is generally used for penetration testing and emulates the type of backdoor framework used by Metasploit, a similar penetration testing tool. Proofpoint researchers have also observed this actor distributing Maze ransomware, employing similar social engineering techniques to those it uses for Cobalt Strike, while also targeting organizations in Italy and impersonating the Agenzia Delle Entrate, the Italian Revenue Agency. We have also recently observed the actor targeting organizations in the United States using the IcedID banking Trojan while impersonating the United States Postal Service (USPS).

🌍 Country Russia

Associated Operations

000 items of personal data compromised in Capcom hack 10TB data allegedly stolen 2019-11 2019-12 2020 2020-01 2020-02 2020-03 2020-04 2020-05 2020-06 2020-07 2020-08 2020-09 2020-10 2020-11 2020-12 2020. As proof of the attack 2021-02 2022-02 350 According to MAZE Allied Universal Breached by Maze Ransomware Berkine became a victim of cyber-attack by the notorious Maze ransomware group that is known for its unique blackmailing practices. Breaking the Ice: A Deep Dive Into the IcedID Banking Trojan’s New Major Version Release Business giant Xerox allegedly suffers Maze Ransomware attack Canon hit by Maze Ransomware attack Chipmaker MaxLinear reports data breach after Maze Ransomware attack Chubb Cyber Insurer Allegedly Hit By Maze Ransomware Attack Crytek data posted on ransomware gang's site Cyber extortionists have stolen sensitive data from a company which supports the US Minuteman III nuclear deterrent. Drug testing firm sends data breach alerts after ransomware attack During the monitoring of deepweb and darkweb leaks Egregor Egregor Claims Responsibility for Barnes & Noble Attack Egregor Ransomware Adopting New Techniques Egregor Ransomware attacked HR Giant Randstad Fairfax County schools hit by Maze ransomware French Hospital Hit with Egregor Ransomware IT services giant Cognizant suffers Maze Ransomware cyber attack Kmart nationwide retailer suffers a ransomware attack LG Electronics allegedly hit by Maze ransomware attack Leaks Data MAZE Relaunches 'Name and Shame' Website MAZE maintains that it has encrypted and exfiltrated data from New York company Threadstone Advisors using ransomware. Maze Ransomware Demands $6 Million Ransom From Southwire Maze Ransomware Operators Allegedly Targeted National Highways Authority of India (NHAI) Maze ransomware is shutting down its cybercrime operation Maze ransomware operators have infected computers from Medical Diagnostic Laboratories (MDLab) and are releasing close to 9.5GB of data stolen from infected machines. On April 1st Package delivery giant Pitney Bowes confirms second ransomware attack in 7 months Ransomware breach of Banco de Costa Rica Retail giant Cencosud hit by Egregor Ransomware attack Stolen Data Leaked The Maze Ransomware gang breached and successfully encrypted the systems of VT San Antonio Aerospace The Maze Ransomware operators are claiming to have successfully attacked business services giant Conduent The Maze hacker gang claims it has infected computer memory maker SK hynix with ransomware and leaked some of the files it stole. The Maze ransomware group attacked the computer systems of Hammersmith Medicines Research (HMR) The master decryption keys for the Maze Ubisoft and Sekhmet ransomware operations were released last night on the BleepingComputer forums by the alleged malware developer. as well as stole and leaked unencrypted files from the company's compromised devices egg producer and supplier Sparboe was cracked into on May 1 https://blog.morphisec.com/egregor-ransomware-adopting-new-techniques https://cybleinc.com/2020/05/22/maze-ransomware-operators-release-the-banco-de-costa-rica-data-leak-part-3/ https://cybleinc.com/2020/07/02/maze-ransomware-operators-allegedly-targeted-national-highways-authority-of-india-nhai-data-leak/ https://cybleinc.com/2020/08/17/one-of-the-largest-steel-sheet-companies-in-southeast-asia-got-allegedly-breached-by-maze/ https://news.sky.com/story/hackers-steal-secrets-from-us-nuclear-missile-contractor-11999442 https://securereading.com/egregor-ransomware-attacked-hr-giant-randstad/ https://securityintelligence.com/posts/breaking-the-ice-a-deep-dive-into-the-icedid-banking-trojans-new-major-version-release/ https://threatpost.com/egregor-responsibility-barnes-noble/160401/ https://www.binarydefense.com/threat_watch/french-hospital-hit-with-egregor-ransomware/ https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/ https://www.bleepingcomputer.com/news/security/business-giant-xerox-allegedly-suffers-maze-ransomware-attack/ https://www.bleepingcomputer.com/news/security/business-services-giant-conduent-hit-by-maze-ransomware/ https://www.bleepingcomputer.com/news/security/canon-hit-by-maze-ransomware-attack-10tb-data-allegedly-stolen/ https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/ https://www.bleepingcomputer.com/news/security/chubb-cyber-insurer-allegedly-hit-by-maze-ransomware-attack/ https://www.bleepingcomputer.com/news/security/drug-testing-firm-sends-data-breach-alerts-after-ransomware-attack/ https://www.bleepingcomputer.com/news/security/fairfax-county-schools-hit-by-maze-ransomware-student-data-leaked/ https://www.bleepingcomputer.com/news/security/hackers-say-they-stole-millions-of-credit-cards-from-banco-bcr/ https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/ https://www.bleepingcomputer.com/news/security/kmart-nationwide-retailer-suffers-a-ransomware-attack/ https://www.bleepingcomputer.com/news/security/lg-electronics-allegedly-hit-by-maze-ransomware-attack/ https://www.bleepingcomputer.com/news/security/maze-ransomware-demands-6-million-ransom-from-southwire/ https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/ https://www.bleepingcomputer.com/news/security/maze-ransomware-not-getting-paid-leaks-data-left-and-right/ https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/ https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/ https://www.bleepingcomputer.com/news/security/us-aerospace-services-provider-breached-by-maze-ransomware/ https://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus https://www.hackread.com/maze-ransomware-group-hacks-oil-giant-leaks-data/ https://www.infosecurity-magazine.com/news/maze-attacks-victoria-beckhams/ https://www.infosecurity-magazine.com/news/maze-claims-ransomware-attack-on-us/ https://www.infosecurity-magazine.com/news/maze-relaunches-name-and-shame/ https://www.nme.com/news/gaming-news/350000-items-of-personal-data-compromised-in-capcom-hack-2818358 https://www.theregister.com/2020/08/20/maze_crew_sk_hynix/ https://www.zdnet.com/article/package-delivery-giant-pitney-bowes-confirms-second-ransomware-attack-in-7-months/ https://www.zdnet.com/article/ubisoft-crytek-data-posted-on-ransomware-gangs-site/ our researchers came across the leak disclosure post in which the Maze ransomware operators allegedly breached Hoa Sen Group and claimed to be in possession of the company’s sensitive data. publishing personal details of thousands of former patients after the company declined to pay a ransom. stores impacted student data leaked the threat group has shared a zip file of data it claims was exfiltrated from Sparboe's systems. where they stole unencrypted files and encrypted devices on their network.

Introduction

Proofpoint researchers detected campaigns from a relatively new actor, tracked internally as TA2101, targeting German companies and organizations to deliver and install backdoor malware. The actor initiated their campaigns impersonating the Bundeszentralamt fur Steuern, the German Federal Ministry of Finance, with lookalike domains, verbiage, and stolen branding in the emails. For their campaigns in Germany, the actor chose Cobalt Strike, a commercially licensed software tool that is generally used for penetration testing and emulates the type of backdoor framework used by Metasploit, a similar penetration testing tool. Proofpoint researchers have also observed this actor distributing Maze ransomware, employing similar social engineering techniques to those it uses for Cobalt Strike, while also targeting organizations in Italy and impersonating the Agenzia Delle Entrate, the Italian Revenue Agency. We have also recently observed the actor targeting organizations in the United States using the IcedID banking Trojan while impersonating the United States Postal Service (USPS).

Activities and Tactics

Country of Origin: 🇷🇺 Russia

Notable Campaigns

  • 000 items of personal data compromised in Capcom hack
  • 10TB data allegedly stolen
  • 2019-11
  • 2019-12
  • 2020
  • 2020-01
  • 2020-02
  • 2020-03
  • 2020-04
  • 2020-05
  • 2020-06
  • 2020-07
  • 2020-08
  • 2020-09
  • 2020-10
  • 2020-11
  • 2020-12
  • 2020. As proof of the attack
  • 2021-02
  • 2022-02
  • 350
  • According to MAZE
  • Allied Universal Breached by Maze Ransomware
  • Berkine became a victim of cyber-attack by the notorious Maze ransomware group that is known for its unique blackmailing practices.
  • Breaking the Ice: A Deep Dive Into the IcedID Banking Trojan’s New Major Version Release
  • Business giant Xerox allegedly suffers Maze Ransomware attack
  • Canon hit by Maze Ransomware attack
  • Chipmaker MaxLinear reports data breach after Maze Ransomware attack
  • Chubb Cyber Insurer Allegedly Hit By Maze Ransomware Attack
  • Crytek data posted on ransomware gang’s site
  • Cyber extortionists have stolen sensitive data from a company which supports the US Minuteman III nuclear deterrent.
  • Drug testing firm sends data breach alerts after ransomware attack
  • During the monitoring of deepweb and darkweb leaks
  • Egregor
  • Egregor Claims Responsibility for Barnes & Noble Attack
  • Egregor Ransomware Adopting New Techniques
  • Egregor Ransomware attacked HR Giant Randstad
  • Fairfax County schools hit by Maze ransomware
  • French Hospital Hit with Egregor Ransomware
  • IT services giant Cognizant suffers Maze Ransomware cyber attack
  • Kmart nationwide retailer suffers a ransomware attack
  • LG Electronics allegedly hit by Maze ransomware attack
  • Leaks Data
  • MAZE Relaunches ‘Name and Shame’ Website
  • MAZE maintains that it has encrypted and exfiltrated data from New York company Threadstone Advisors using ransomware.
  • Maze Ransomware Demands $6 Million Ransom From Southwire
  • Maze Ransomware Operators Allegedly Targeted National Highways Authority of India (NHAI)
  • Maze ransomware is shutting down its cybercrime operation
  • Maze ransomware operators have infected computers from Medical Diagnostic Laboratories (MDLab) and are releasing close to 9.5GB of data stolen from infected machines.
  • On April 1st
  • Package delivery giant Pitney Bowes confirms second ransomware attack in 7 months
  • Ransomware breach of Banco de Costa Rica
  • Retail giant Cencosud hit by Egregor Ransomware attack
  • Stolen Data Leaked
  • The Maze Ransomware gang breached and successfully encrypted the systems of VT San Antonio Aerospace
  • The Maze Ransomware operators are claiming to have successfully attacked business services giant Conduent
  • The Maze hacker gang claims it has infected computer memory maker SK hynix with ransomware and leaked some of the files it stole.
  • The Maze ransomware group attacked the computer systems of Hammersmith Medicines Research (HMR)
  • The master decryption keys for the Maze
  • Ubisoft
  • and Sekhmet ransomware operations were released last night on the BleepingComputer forums by the alleged malware developer.
  • as well as stole and leaked unencrypted files from the company’s compromised devices
  • egg producer and supplier Sparboe was cracked into on May 1
  • https://blog.morphisec.com/egregor-ransomware-adopting-new-techniques
  • https://cybleinc.com/2020/05/22/maze-ransomware-operators-release-the-banco-de-costa-rica-data-leak-part-3/
  • https://cybleinc.com/2020/07/02/maze-ransomware-operators-allegedly-targeted-national-highways-authority-of-india-nhai-data-leak/
  • https://cybleinc.com/2020/08/17/one-of-the-largest-steel-sheet-companies-in-southeast-asia-got-allegedly-breached-by-maze/
  • https://news.sky.com/story/hackers-steal-secrets-from-us-nuclear-missile-contractor-11999442
  • https://securereading.com/egregor-ransomware-attacked-hr-giant-randstad/
  • https://securityintelligence.com/posts/breaking-the-ice-a-deep-dive-into-the-icedid-banking-trojans-new-major-version-release/
  • https://threatpost.com/egregor-responsibility-barnes-noble/160401/
  • https://www.binarydefense.com/threat_watch/french-hospital-hit-with-egregor-ransomware/
  • https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/
  • https://www.bleepingcomputer.com/news/security/business-giant-xerox-allegedly-suffers-maze-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/business-services-giant-conduent-hit-by-maze-ransomware/
  • https://www.bleepingcomputer.com/news/security/canon-hit-by-maze-ransomware-attack-10tb-data-allegedly-stolen/
  • https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/chubb-cyber-insurer-allegedly-hit-by-maze-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/drug-testing-firm-sends-data-breach-alerts-after-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/fairfax-county-schools-hit-by-maze-ransomware-student-data-leaked/
  • https://www.bleepingcomputer.com/news/security/hackers-say-they-stole-millions-of-credit-cards-from-banco-bcr/
  • https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/
  • https://www.bleepingcomputer.com/news/security/kmart-nationwide-retailer-suffers-a-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/lg-electronics-allegedly-hit-by-maze-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/maze-ransomware-demands-6-million-ransom-from-southwire/
  • https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/
  • https://www.bleepingcomputer.com/news/security/maze-ransomware-not-getting-paid-leaks-data-left-and-right/
  • https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/
  • https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/
  • https://www.bleepingcomputer.com/news/security/us-aerospace-services-provider-breached-by-maze-ransomware/
  • https://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus
  • https://www.hackread.com/maze-ransomware-group-hacks-oil-giant-leaks-data/
  • https://www.infosecurity-magazine.com/news/maze-attacks-victoria-beckhams/
  • https://www.infosecurity-magazine.com/news/maze-claims-ransomware-attack-on-us/
  • https://www.infosecurity-magazine.com/news/maze-relaunches-name-and-shame/
  • https://www.nme.com/news/gaming-news/350000-items-of-personal-data-compromised-in-capcom-hack-2818358
  • https://www.theregister.com/2020/08/20/maze_crew_sk_hynix/
  • https://www.zdnet.com/article/package-delivery-giant-pitney-bowes-confirms-second-ransomware-attack-in-7-months/
  • https://www.zdnet.com/article/ubisoft-crytek-data-posted-on-ransomware-gangs-site/
  • our researchers came across the leak disclosure post in which the Maze ransomware operators allegedly breached Hoa Sen Group and claimed to be in possession of the company’s sensitive data.
  • publishing personal details of thousands of former patients after the company declined to pay a ransom.
  • stores impacted
  • student data leaked
  • the threat group has shared a zip file of data it claims was exfiltrated from Sparboe’s systems.
  • where they stole unencrypted files and encrypted devices on their network.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Backdoor.Oldrea
  • Trojan.Karagany
  • Trojan.Mebromi
  • UNITEDRAKE
  • Archelaus Beta
  • Cobalt Strike
  • Revenge-RAT
  • Maze ransomware:
  • 7-Zip:
  • BloodHound:
  • BokBot:
  • Buran:
  • Cobalt Strike:
  • Egregor:
  • Maze:
  • Mimikatz:
  • PsExec:
  • SharpHound:
  • WinSCP:
  • nmap:

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

References pending cataloguing.