Xerox becomes latest Maze ransomware victim
The ransomware group claims a bunch of new victims including the business printing giant
The Maze ransomware group has claimed a new set of victims, including Xerox, WorldNet Telecommunications, Columbus Metro Federal Credit Union and Webuild Spa.
The ransomware group claims to have stolen more than 100GB of files from Xerox and will make them public if the firm doesn’t engage in negotiations for a ransom payment, Bleeping Computer reports.
“After the payment the data will be removed from our disks and decryptor will be given to you, so you can restore your files,” a ransom note sent to Xerox by the Maze operators read.
This comes just weeks after the nefarious ransomware operators leaked source code data belonging to LG Electronics. Cyble stumbled upon the data leak while monitoring the dark web, and has seen screenshots confirming that the Maze hackers were behind the attack.
“One of the screenshots seems to consist of LG Electronics official firmware or software update releases that assist their hardware products to work more efficiently. While the other screenshot seems to list out the source code of its products,” said Cyble.
Cyble was also this week able to confirm a Maze-related data leak targeting the American Osteopathic Association. At the time of reporting, the ransomware operators claimed to have uploaded 5% of the total data leak.
Beyond targeting new victims, Maze has begun posting pre-leak warnings along with the occasional press release. On June 22, the ransomware operators published a press release cautioning its victims against decrypting stolen files. The operators warned victims trying to decrypt files themselves are "more close to suicide than recovery."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
In another post, the group provided examples of stolen data from companies that attempted using a negotiator to restore their data but ultimately failed to do so. Those companies included ST engineering, MaxLinear, Conduent and M.J. Brunner.
The Maze group has targeted a wide range of organizations in recent weeks. Recent targets have also included high-profile organizations like VT San Antonio Aerospace and Westech International.
-
Zscaler and Schwarz Digits team up on sovereign cloud security platformNews The sovereign Zero Trust SASE service is aimed at critical sectors such as government, defense, finance, and healthcare
-
A new vishing campaign is targeting Microsoft TeamsNews Researchers warn Microsoft Teams users across North America are in the crosshairs
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals