Maui Ransomware · 2022-07
North Korean state-sponsored actors, with later reporting linking a 2021 case to Andariel, used Maui ransomware in a manually operated encryption campaign affecting healthcare and other financially viable organizations in the United States and Japan. The malware encrypted selected servers and files through command-line execution, used AES/RSA/XOR routines with local key and log artifacts, and caused disruption to healthcare services including electronic health records, diagnostics, imaging, and intranet systems.
Targeting of various industries with Maui ransomware · Jul 2022
The Lazarus Group used Maui ransomware to target government and civil institutions in order to raise money for the North Korean government.
Maui Ransomware attacks · July
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel. RGB Unit: Andariel; Case Name: Maui Ransomware attacks; VAS √; VAS Value: N/A; Publicized Month: July. (SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures)
Maui Ransomware · 2022-07
Reported: 2022-07; Victims: Maui Ransomware; Motivations: FinancialGain; Sectors: Healthcare; Countries: United States, Japan
Maui ransomware against Healthcare and Public Health Sector · July 07, 2022 (activity since at least May 2021)
to provide information on Maui ransomware, which has been used by North Korean state-sponsored cyber actors since at least May 2021 to target Healthcare and Public Health (HPH) Sector organizations.
Maui ransomware deployment by North Korea-linked operating modes · entre mai 2021 et juillet 2022
Si les modes opératoires liés à la Corée du Nord sont connus pour déployer régulièrement des rançongiciels comme Maui entre mai 2021 et juillet 2022
Maui ransomware campaign against U.S. healthcare organizations (at least five U.S.-based healthcare entities) · Between the initial May 2021 attack and July 2022
Between the initial May 2021 attack and July 2022, the FBI responded to multiple Maui ransomware incidents at other U.S. organizations in the healthcare sector. ... Information obtained during this investigation indicates that Andariel has committed ransomware attacks against at least five U.S.-based healthcare entities and then used the proceeds to finance its espionage operations. [Case No. 6:26-cv-01047, U.S. District Court for the District of Kansas; filing: COMPLAINT with trial location of Wichita, filed by United States of America.]
“Maui Ransomware” campaign against the health-care and public health sector · since May 2021
Footnote 110: “On 6 July 2022, the Government of the United States of America (Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency and Treasury) warned through a joint cybersecurity advisory that a ransomware variant called “Maui Ransomware” was being used in a campaign run by Democratic People’s Republic of Korea cyberthreat actors since May 2021, primarily to target organizations in the health-care and public health sector.”
Maui ransomware against five U.S. hospitals and medical providers · 2021 and 2022
(MSMT/2025/2, report p. 11 (fn 6)) Footnote 6: “In 2021 and 2022, DPRK Cyber Actor Rim Jong Hyok and his co-conspirators, associated with the APT Andariel, deployed Maui ransomware to extort five U.S. hospitals and medical providers. The DPRK cyber actors used ransomware to deny healthcare workers access to computer systems, restricting their ability to access key tools for patient care, electronic patient records, and internal servers that forced healthcare providers to limit services and cancel appointments.”