Campaigns / Malware / Family

Maze

Maze ransomware, previously known as "ChaCha", was discovered in May 2019.

26New IOCs · 24h

26New IOCs · 7 days

26Indicators tracked

1Independent feeds

2026-10-11 15:16Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash16
IP10
Malware26

MITRE ATT&CK lists this as malware Maze. Explore the ATT&CK matrix →

Where its infrastructure is hosted

🇷🇺 Russia10

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-11 15:16	SHA256	3c3615531a3173b2f778e8a9f95cc6b4e98534ccc8c19c96fbeb8a5076bd5d88	Malware sample	—
2026-10-11 15:16	SHA256	4a7a611c2c20e5110ddf693b86cabe75e74f3cc690fc98ace765ae0b5231379b	Malware sample	—
2026-10-11 15:16	SHA256	4df5759f02635cb279a491fde8dc2392ae92083531a1d5d80d6ca202cbbd3922	Malware sample	—
2026-10-11 15:16	IP	91.218.114[.]4	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]11	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]25	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]77	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]31	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]79	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]26	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]32	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]37	Contacted by malware	—
2026-10-11 15:16	IP	91.218.114[.]38	Contacted by malware	—
2026-10-11 14:59	SHA256	1963d7601c3b82c7256b1e2faa7cf0c4e2c10c202a6926ce7a3114e61982ba1c	Malware sample	—
2026-10-11 14:59	SHA256	3553e60605178bcddcb6243f33b8d9b472c0500a26c1f4c4c3ff36e129cee9b3	Malware sample	—
2026-10-11 14:59	SHA256	5a06ae8540d5a0d7fb88e80d3e61c3a6079f3abdafe998ce70ffdcac9e940520	Malware sample	—
2026-10-11 14:43	SHA256	22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0	Malware sample	—
2026-10-11 14:43	SHA256	48790fb91ad8ebe6db606a4d9a98d1f2ad26b5b9f2e26297b929e5953704fb9d	Malware sample	—
2026-10-11 14:27	SHA256	506cffee14b1d82e45ff110b1f9ee1dc7dfc38f729236d3dfcd9512ff84e34d0	Malware sample	—
2026-10-11 14:09	SHA256	1de59d87840d41c7e779809708794ee9a9d5992f1ed113f3ede79aa6f33fd09d	Malware sample	—
2026-10-11 14:09	SHA256	32a4f0bcda9006193852768df04d251f2ee8fa4294242f63af9d89c1773f6b88	Malware sample	—
2026-10-11 14:09	SHA256	3645ca9ccd69bb7bef64843e8d79e20e98faee45c94f56dccb67a83616f8f827	Malware sample	—
2026-10-11 14:09	SHA256	485da83d711d4f9b1f968c7c7e62b30a9987e7cc5a961e5b92a4ab9fcb11611d	Malware sample	—
2026-10-11 14:09	SHA256	5094956aca00a39f205b83898e38dac3ef5c75781acf4c619af290079dea641b	Malware sample	—
2026-10-11 14:09	SHA256	512cdfb0645fb0fe040c2ba7d37625cde03c2d0fe32966558f5374a19afa65ea	Malware sample	—
2026-10-11 14:09	SHA256	65774dcf6d6e9a55be4250a1c95c93a92913bdbfcffce66af4bf7c8f4719489c	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check