New Ransomware Tactic: Pay Us or the World Sees Your Keys

The creators of Maze Ransomware have added a new wrinkle to the typical hacker’s MO. Instead of quietly infecting and requesting ransom from victims, the so-called Maze team is publicly exposing victims by displaying real files exfiltrated from their hacked servers.

This tactic could be a disaster for crypto companies that may have put private keys or other important financial data into their private archives, should they be breached.

“Represented here companies don’t wish to cooperate with us, and trying to hide our successful attack on their resources. Wait for their databases and private papers here,” write the hackers on their public website, mazenews.top. “Follow the news!”

Companies that have already been hit by the group include a grocery chain, Busch’s Inc., in Ann Arbor, Mich., and a lawn and garden company, Massey Services, in Florida. We’ve reached out to the alleged Maze victims; many have already made public information about the hacks on their websites.

Another group, called REvil, promises to release for free or sell vital company information to competitors if its ransom is not paid. The hackers wrote:

“For years, ransomware developers and affiliates have been telling victims that they must pay the ransom or stolen data would be publicly released,” said Lawrence Abrams, ransomware researcher at BleepingComputer. “While it has been a well-known secret that ransomware actors snoop through victim’s data, and in many cases steal it before the data [are] encrypted, they never actually carried out their threats of releasing it.”

“This is especially ghastly news for companies that may already face steep fines and other penalties for failing to report breaches and safeguard their customers’ data. For example, healthcare providers are required to report ransomware incidents to the U.S. Department of Health and Human Services, which often documents breaches involving lost or stolen healthcare data on its own site,” wrote security researcher Brian Krebs.

A list of invoices is one thing; publicizing the keys to a company’s crypto accounts are another thing entirely. Given the amount of data involved, there’s no telling what valuable information could be lurking amid a company’s paperwork.

One victim was quick to publicly react to a Dec. 9 attack.

“As early as Tuesday morning [Dec. 10], we began bringing key business systems back online, prioritizing manufacturing and logistics functions that enable us to make and ship quality products to our customers,” wrote Rich Stinson CEO of manufacturer SouthWire. “We are working diligently with our cybersecurity partner to understand the facts behind this event, resolve this disruption and resume normal business operations as quickly as possible.”