Malware

Maze

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Aug 17, 2026 · last 29d ago

Timeline1 articles

Threat Brief: Maze Ransomware

Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.

Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.

Palo Alto Unit 42Aug 17, 13:17 UTC · 29d agoRansomware in the wildCVE-2018-15982 CVE-2018-4878 CVE-2019-11510+1 CVEs

Related CVEsby mentions

CVE-2019-1151010.0100%
Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.
· Ivanti Pulse Connect Secure KEV ransomware PoC ×2large
CVE-2018-48787.890%
Use-After-Free RCE in Adobe Flash Player before 28.0.0.161
CVE-2018-4878 is a use-after-free (CWE-416) in Adobe Flash Player before 28.0.0.161, caused by a dangling pointer in the Primetime SDK's media-player handling of listener objects. An attacker triggers it by persuading a user to open attacker-controlled Flash content — typically a malicious SWF delivered via email, Office documents, or malvertising/exploit kits — because the CVSS vector (AV:L, UI:R) requires local user interaction. Successful exploitation yields arbitrary code execution with the privileges of the user running Flash. Anyone running a vulnerable Flash Player was exposed, including Red Hat Enterprise Linux Desktop/Server/Workstation users running Red Hat's packaged Flash plugin. The flaw was exploited as a zero-day in January–February 2018 (documented by McAfee and distributed alongside the Fallout exploit kit), and it remains in CISA's KEV with known ransomware use.
· adobe Flash Player all versions before 28.0.0.161 · redhat Enterprise Linux Desktop (flash-plugin) Flash Player component before 28.0.0.161 KEV ransomware PoC ×2mass
CVE-2018-159827.889%
Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution
CVE-2018-15982 is a use-after-free flaw (CWE-416) in Adobe Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier, in which Flash frees memory that is subsequently reused, corrupting process memory. It is triggered when Flash processes crafted Flash content, most notably embedded in Microsoft Office documents, requiring a user to open or view the malicious content (CVSS attack vector is local with user interaction required). Successful exploitation gives the attacker arbitrary code execution with the privileges of the user viewing the content. Affected users include anyone running the listed Flash Player versions, including the Flash Player Installer and the Adobe-supplied Flash plugin shipped with Red Hat Enterprise Linux Desktop, Server and Workstation. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use, a public exploit is available on Exploit-DB, and EPSS assigns a top-percentile 89.1% probability of exploitation within 30 days.
· Adobe Flash Player 31.0.0.153 and earlier, and 31.0.0.108 and earlier · Adobe Flash Player Installer Same affected ranges as Flash Player (31.0.0.153 and earlier / 31.0.0.108 and earlier) KEV ransomware PoC mass
CVE-2018-81747.588%
Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine
CVE-2018-8174 is an out-of-bounds write (CWE-787) in the Microsoft Windows VBScript engine, caused by the way it handles objects in memory. An attacker triggers it by convincing a user to visit a specially crafted website or open crafted content that invokes the VBScript engine (for example via Internet Explorer or a document preview), requiring user interaction. Successful exploitation yields remote code execution with the privileges of the logged-on user, enabling program installation, data theft and account takeover. All listed Windows client and server releases are affected: Windows 7, 8.1, RT 8.1, Windows 10 (1607-1803), and Windows Server 2008/2008 R2, 2012/2012 R2, 2016. Exploitation is in the wild: the flaw was fixed in the May 2018 Patch Tuesday, is listed in CISA KEV with known ransomware use, and public PoCs (0patch, ExploitDB 44741) and exploit kit usage have been documented; EPSS puts its 30-day exploitation probability at 88.5%.
· microsoft windows 10 1607, 1703, 1709, 1803 (pre-May 2018 security updates) · microsoft windows 7 all supported builds prior to the May 2018 security update KEV ransomware PoC ×2mass

Appears with

malware ChaCha 1 organization Palo Alto Networks 1 organization Unit 42 1 product Cortex XDR 1 product WildFire 1 vendor McAfee 1 vendor Palo Alto Networks 1 vendor Pulse Secure 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.