Threat actor · all actors
Maui ransomwareMISP-995c3772 criminal
aka Maui ransomware
Last updated: 2026-08-22
11attributed CVEs
0ATT&CK techniques
31.9IDF score (tooling uniqueness)
0exclusive CVEs
2018–2022years active
About this actor
Maui ransomware stand out because of a lack of several key features commonly seen with tooling from RaaS providers, such as an embedded ransom note to provide recovery instructions or automated means of transmitting encryption keys to attackers. Instead, it is believed that Maui is manually operated, in which operators will specify which files to encrypt when executing it and then exfiltrate the resulting runtime artifacts. There are many aspects to Maui ransomware that are unknown, including usage context.
How we know this
- Data origin
- MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
- Techniques
- No ATT&CK techniques mapped.
- Named victims
- None on file.
Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.
See how actor data is built for the full pipeline.
Activity timeline
- 2022 — 7 CVE published
- 2021 — 2 CVE published
- 2019 — 1 CVE published
- 2018 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2021-3018 | 9.9 | 9.8 | 0.7933 | 2021-01-05 | see CVE |
CVE-2021-45837 | 9.9 | 9.8 | 0.8108 | 2022-04-25 | see CVE |
CVE-2021-44142 | 9.1 | 8.8 | 0.7404 | 2022-02-21 | see CVE |
CVE-2022-22005 | 7.7 | 8.8 | 0.1721 | 2022-02-09 | see CVE |
CVE-2019-15637 | 7.4 | 8.1 | 0.2273 | 2019-08-26 | see CVE |
CVE-2022-24665 | 7.4 | 9.9 | 0.0260 | 2022-02-16 | see CVE |
CVE-2022-24663 | 7.3 | 9.9 | 0.0210 | 2022-02-16 | see CVE |
CVE-2022-24664 | 7.3 | 9.9 | 0.0165 | 2022-02-16 | see CVE |
CVE-2021-40684 | 7.1 | 9.1 | 0.0124 | 2021-09-22 | see CVE |
CVE-2022-24785 | 6.5 | 7.5 | 0.0566 | 2022-04-04 | see CVE |
CVE-2017-4946 | 5.9 | 7.8 | 0.0051 | 2018-01-05 | see CVE |
No techniques attributed.
Co-occurring actors
- Andariel 11 shared CVEs
- Lazarus Group 11 shared CVEs
- Storm-0530 11 shared CVEs
Similar actors
Overlapping CVEs
- Andariel 1.00
- Storm-0530 1.00
- Lazarus Group 0.92
Active in same years
- Lazarus Group 4.00
- Andariel 4.00
- Storm-0530 4.00
- APT29 2.00
- C0018 1.00
Same category
- LAPSUS$ 1.00
- Akira 1.00
- INC Ransom 1.00
- Play 1.00
- BlackByte 1.00