Maui
Maui is a ransomware group with an espionage motive, tracked by Brandefense. It targets the Government and Healthcare sectors in the United States.
- Maui ransomware
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About Maui.
Maui Ransomware is used an APT/Nation State group primarily motivated by espionage. The group mainly targets Healthcare and Public Health (HPH) organizations, defense contractors, nuclear facilities, and critical infrastructure networks globally (including the United States and South Korea), and is assessed to operate with strategic sophistication. It is commonly associated with exploiting unpatched public-facing vulnerabilities (e.g., Log4j CVE-), deploying the DTrack backdoor, and manually executing Maui ransomware. It is known for its dual mandate of conducting cyber espionage to steal sensitive intelligence while launching financially motivated ransomware attacks to fund the DPRK regime.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.