5b7ecf7e9d0715f1122baf4ce745c5fcd769dee48150616753fec4d6da16e99e

Maui ransomware sample (maui.exe). FBI / CISA / Treasury advisory AA22-187A documents its use by DPRK state actors against U.S. Healthcare and Public Health sector targets from at least May 2021. Encryption combines AES, RSA and XOR and is driven manually via CLI by the operator.

family

Maui

first seen

Apr 30, 2021

publisher

CISA