Threat Intelligence Report April 15 - April 21 2025

Maui Ransomware Group

Maui is a manually operated ransomware strain first identified in early 2021 and attributed to North Korean state-sponsored threat actors. Unlike ransomware-as-a-service (RaaS) models, Maui does not automatically display ransom notes or exfiltrate data. Instead, it is designed for targeted attacks against critical infrastructure, particularly within the healthcare sector. Its operations are human-driven at every stage—from deployment to ransom negotiation—reflecting a highly curated approach.

Although not equipped with automated features such as lateral movement or backup deletion, Maui’s encryption mechanisms are sophisticated and highly disruptive. The ransomware is typically executed with command-line arguments, targeting specific directories and encrypting data using a hybrid AES-RSA scheme. Its selective and stealthy behaviour, coupled with the absence of widespread campaigns, signals a strategic focus on high-value targets.

Detailed TTPs

Initial Access
North Korean actors gain entry via spear-phishing campaigns or exposed RDP services. The FBI and CISA have highlighted that, although no universal initial access vector has been confirmed, phishing and RDP exploitation remain consistent with previous nation-state tactics.

Persistence & Lateral Movement
Once inside, attackers establish persistence using valid credentials or by creating local accounts. Tools like Cobalt Strike, Empire, and Metasploit are employed for post-exploitation control, lateral movement, and privilege escalation.

Execution
Maui is launched manually using command-line instructions (maui.exe <target directory>). Operators specify parameters such as thread count and logging directories, confirming hands-on execution.

Encryption Behaviour
Maui uses:

• AES-128 (CBC mode) for per-file encryption
• RSA encryption for AES keys
• XOR obfuscation of key files
  It writes encrypted data to .tmp files before renaming them and generates an execution log (maui.log), which is exfiltrated along with the RSA private keys for later decryption post-payment.

Command & Control
Maui does not feature built-in C2 communication. Instead, attackers leverage external tools like Cobalt Strike to maintain remote control, often communicating over HTTPS to blend in with normal traffic.

Impact
The impact centres on data encryption (T1486) and disruption of services, particularly healthcare operations. Maui does not delete backups but may disable or remove them manually. The lack of data exfiltration shifts the focus from double-extortion to targeted ransom demands.

MITRE ATT&CK TTP Mapping

IOCs

Filenames:

Mitigation Strategies

• Endpoint Detection & Response (EDR): Use behaviour-based EDRs like SentinelOne or CrowdStrike to catch CLI encryption behaviours and automatically roll back changes.
• Patch Management: Regularly patch VPN/RDP services and internal applications to prevent exploitation.
• Network Segmentation: Isolate critical systems and implement strict access controls to hinder lateral movement.
• Multi-Factor Authentication (MFA): Enforce MFA for all administrative and remote access accounts.
• User Awareness Training: Train staff to detect and report phishing attempts to reduce the risk of initial access.
• Credential Hygiene: Regularly audit and disable unused accounts. Use strong, unique credentials.
• Backup and Disaster Recovery: Maintain offline, immutable backups and test restore procedures frequently.
• Monitoring and Incident Response: Deploy SIEMs and threat-hunting tools. Monitor for the presence of maui.exe, maui.log, or related indicators.

Ransomware Victims Worldwide

A recent analysis of the global ransomware threat landscape indicates that the United States continues to be the most heavily impacted nation, accounting for a staggering 58.16% of all reported ransomware incidents. This reinforces the country’s position as a prime target for financially and politically motivated threat actors.

Germany ranks second, experiencing 9.22% of global attacks — a sharp indication of the country's exposure within the European economic and industrial sphere. Canada follows with 4.96%, while the United Kingdom reports 4.26%, reflecting persistent threats across North American and Western European nations.

Several other countries also show notable ransomware activity. Spain and Italy each report 2.84% of incidents, while Portugal is close behind at 2.13%, highlighting a broader European trend. Australia, Norway, Brazil, and Switzerland each recorded 1.42%, suggesting ransomware groups are diversifying their target selection across regions and verticals.

A range of countries reported moderate to low levels of incidents, each contributing 0.71% of global ransomware cases. These include Vietnam, Chile, Argentina, Luxemburg, Indonesia, Saudi Arabia, India, Bolivia, China, Taiwan, Netherlands, Czech Republic, Ireland, and Greece. While smaller in share, these nations’ inclusion underscores the increasingly global footprint of ransomware operations.

This widespread distribution of ransomware victims emphasises the transnational nature of modern cybercrime. It calls for urgent international collaboration in intelligence sharing, the adoption of advanced threat detection mechanisms, and the strengthening of cyber resilience programs across both public and private sectors.