The Demon Maze, Inventor of the Pillory

Legend

Appearing in May 2019, it popularised double extortion: those who didn't pay saw their data published. It presented itself as a "cartel" with other gangs. In November 2020 it announced its retirement, while its affiliates moved to other brands.

Exorcism

Cast it out by reducing exposed sensitive data and encrypting it at rest, so that even a stolen copy is worth little. Add exfiltration monitoring and offline backups.

Technical record

Also known as: ChaCha ransomware
Circle: Circle III · Ransomware and extortion
First seen: 2019
Status: Dormant

Ransomware first seen in May 2019 that popularised double extortion, publishing stolen data when victims refused to pay. It operated as a 'cartel' with other gangs. Its operators announced retirement in November 2020, with affiliates moving to Egregor.

Sources: attack.mitre.org · en.wikipedia.org · MITRE ATT&CK reference S0449