Ransomware group profile · #90 by claimed victims
Maze ransomware
Maze ransomware group is one of the most known ransomware gangs, they targeted organizations worldwide across many industries. Security researchers believed that Maze operates as an affiliated network model. MAZE was one of the first groups that made a 'Double Extortion Attack' involved Allied Universal, in November 2019, the group leaks their victim's data in the darknet. On November 1, 2020, MAZE announced an official press release that they are closing their operation. is malware targeting organizations worldwide across many industries. Security researchers claim that the threat actor behind the MAZE group is 'TA2101'.
Victimology
Who Maze claims to have breached, from 59 leak-site posts recorded by VULONE.
Claims per month last 12 months
Top sectors
Top countries
Latest claimed victims 12 most recent
| Victim | Sector | Country | Claimed |
|---|---|---|---|
| Fairfax County Public Schools | Education | US | 11 Sep 2020 |
| Toledo Public Schools (TPS) | Education | US | 8 Sep 2020 |
| Artech Information Systems | Technology | US | 1 Sep 2020 |
| Canon | Manufacturing | US | 5 Aug 2020 |
| SK Hynix (semiconductor company) | Manufacturing | — | 1 Aug 2020 |
| Strata Plus (strata management firm) | Professional Services | AU | 25 Jul 2020 |
| X-FAB | Manufacturing | US | 5 Jul 2020 |
| Thai Beverage Public Company | Agriculture and Food Production | TH | 1 Jul 2020 |
| Ostermeir FZE (engineering firm) | Manufacturing | AE | 29 Jun 2020 |
| VirtualGuard | Government & Defense | US | 28 Jun 2020 |
| Xerox Corporation xerox.com | Technology | GB | 25 Jun 2020 |
| Domingos Martins | Government & Defense | BR | 10 Jun 2020 |
BRAll 59 Maze victims, searchable
Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.
Tactics, techniques and procedures
ATT&CK technique mapping for Maze is in progress. Victimology, infrastructure status and leak-site tracking are live above.
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Frequently asked
Is Maze ransomware still active?
How many victims has Maze claimed?
Which industries does Maze target?
Which countries are most affected by Maze?
Where does VULONE get Maze victim data?
Other ransomware groups
Qilin
Lockbit3
Akira
ClopVictim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].
