Security researchers spotted a campaign involving Maze ransomware that bases the cost of recovering stolen data on the type of device its victim is using.
First spotted by a researcher from Malwarebytes and described in detail on Bleeping Computer, the campaign attempts to lure potential victims by posing as an online cryptocurrency exchange service called Abra. The attackers are reportedly purchasing traffic from ad networks to increase their chances of being found, and those who visit the website are hit with the Fallout exploit kit after being redirected to a landing page. Maze ransomware then encrypts files and changes extensions after scanning through the device.
Attackers Adjust Ransom Demand According to Device Type
Although cyberattackers traditionally don’t discriminate as far as the types of machines they infect, the Maze operators tweaked the ransomware to learn more details about its victims. A personal computer used at home, for instance, might be less valuable than a workstation or server run by a large organization.
The attacker’s message appears on the victim’s desktop, states that the files on the machine have been encrypted and prompts the user to purchase a decryptor to recover the compromised data. According to screenshots published by Bleeping Computer, the notes include references to the type of device the victim is using — for example, “We know that this computer is a home computer So [sic] we will give you appropriate price for recovering.” The ransom note is saved as DECRYPT-FILES.html with an email address that ends with the .africa domain.
The ransomware tries to connect with 15 sites whose IP addresses begin with a “92,” though it’s unclear why. The encryption approach is based on the ChaCha keys and RSA. To recover their files, victims are prompted to use a private decryption key to send details such as their name, Windows version and computer ID to the attackers.
Don’t Give in to Maze Ransomware
No matter what kind of computer you have, your first instinct in the event of a Maze ransomware attack might be to simply pay up. However, security professionals caution against giving in to attackers’ demands and instead recommend establishing a solid backup strategy to isolate the compromised machine and secure other parts of the network from unnecessary risks.