maze

Maze ransomware pioneered the double-extortion model in late 2019, becoming the first major group to combine file encryption with data theft and public shaming via a dedicated leak site — a model that has since defined the entire ransomware industry. Attributed to Russian-speaking operators, Maze also formed the first ransomware cartel, sharing a leak platform with RagnarLocker, SunCrypt, and Egregor. Maze formally retired in October 2020; its developers and affiliates subsequently launched the Egregor and Sekhmet operations.