Security Resilience

Threat actor · all actors

Maui ransomwareMISP-995c3772 criminal

aka Maui ransomware

Last updated: 2026-10-16

44attributed CVEs
0ATT&CK techniques
117.8IDF score (tooling uniqueness)
0exclusive CVEs
2018–2025years active

About this actor

Maui ransomware stand out because of a lack of several key features commonly seen with tooling from RaaS providers, such as an embedded ransom note to provide recovery instructions or automated means of transmitting encryption keys to attackers. Instead, it is believed that Maui is manually operated, in which operators will specify which files to encrypt when executing it and then exfiltrate the resulting runtime artifacts. There are many aspects to Maui ransomware that are unknown, including usage context.

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2018: 1 CVE published120182019: 3 CVE published320192021: 8 CVE published2021: 4 KEV added1220212022: 14 CVE published2022: 9 KEV added2320222023: 18 CVE published2023: 15 KEV added3320232025: 1 KEV added12025
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-7609 KEV10.010.00.97342019-03-25see CVE
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2022-22947 KEV10.010.00.98252022-03-03see CVE
CVE-2023-46604 KEV10.010.00.99892023-10-27see CVE
CVE-2019-0708 KEV9.99.81.00002019-05-16see CVE
CVE-2021-20028 KEV9.99.80.85852021-08-04see CVE
CVE-2021-20038 KEV9.99.80.99912021-12-08see CVE
CVE-2021-3018 9.99.80.79332021-01-05see CVE
CVE-2021-41773 KEV9.99.80.99992021-10-05see CVE
CVE-2021-45837 9.99.80.81082022-04-25see CVE
CVE-2022-22965 KEV9.99.80.99722022-04-01see CVE
CVE-2022-41352 KEV9.99.80.97012022-09-26see CVE
CVE-2022-47966 KEV9.99.80.99752023-01-18see CVE
CVE-2023-25690 9.99.80.84512023-03-07see CVE
CVE-2023-27997 KEV9.99.80.92422023-06-13see CVE
CVE-2023-28771 KEV9.99.80.99282023-04-25see CVE
CVE-2023-33010 KEV9.99.80.29022023-05-24see CVE
CVE-2023-33246 KEV9.99.80.97362023-05-24see CVE
CVE-2023-34362 KEV9.99.80.99932023-06-02see CVE
CVE-2023-35078 KEV9.99.81.00002023-07-25see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2023-42793 KEV9.99.80.99992023-09-19see CVE
CVE-2022-25064 9.79.80.63102022-02-25see CVE
CVE-2023-2868 KEV9.79.40.91452023-05-24see CVE
CVE-2023-3079 KEV9.28.80.37862023-06-05see CVE
CVE-2023-32315 KEV9.28.61.00002023-05-26see CVE
CVE-2021-44142 9.18.80.74042022-02-21see CVE
CVE-2021-36955 KEV8.57.80.26462021-09-15see CVE
CVE-2021-43226 KEV8.57.80.12292021-12-15see CVE
CVE-2022-24990 KEV8.57.50.96752023-02-07see CVE
CVE-2022-30190 KEV8.57.80.99372022-06-01see CVE
CVE-2023-32784 8.47.50.76482023-05-15see CVE
CVE-2022-27925 KEV8.17.20.98682022-04-21see CVE
CVE-2023-0669 KEV8.17.21.00002023-02-06see CVE
CVE-2022-21882 KEV7.97.00.90452022-01-11see CVE
CVE-2022-22005 7.78.80.17212022-02-09see CVE
CVE-2019-15637 7.48.10.22732019-08-26see CVE
CVE-2022-24665 7.49.90.02622022-02-16see CVE
CVE-2022-24663 7.39.90.02102022-02-16see CVE
CVE-2022-24664 7.39.90.01662022-02-16see CVE
CVE-2021-40684 7.19.10.01252021-09-22see CVE
CVE-2023-21932 7.17.20.44962023-04-18see CVE
CVE-2022-24785 6.97.50.13902022-04-04see CVE
CVE-2017-4946 5.97.80.00532018-01-05see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same category