OAK-S25 — Maui ransomware

Description

Maui is a Korean-developed Windows ransomware family attributed to the DPRK-state-sponsored Andariel sub-cluster of the broader Lazarus constellation, deployed against U.S. healthcare and public-health sector targets from May 2021 onward. The canonical reference is the CISA / FBI / Treasury joint cybersecurity advisory AA22-187A of July 6, 2022 ([cisaaa22187a]), which named the family, attributed it to DPRK state-sponsored actors, documented the targeting profile (healthcare and public-health sector specifically), and warned that ransom payment would constitute potential OFAC-sanctions-violation given the DPRK-attribution. The DOJ indictment of Andariel operative Rim Jong Hyok unsealed July 25, 2024 ([doj2024rimjonghyok]) provides the named-defendant confirmed-grade attribution anchor and explicitly identifies Maui as the encryptor deployed in the healthcare-sector campaign that funded follow-on Andariel cyber-espionage operations against U.S. defence-industrial-base, NASA, and energy targets — a defining operational pattern in which the ransomware proceeds funded the espionage operation rather than the espionage operation existing on its own appropriation budget.

The family's distinguishing technical feature is operator-supplied per-victim AES key management: Maui does not auto-generate encryption keys, does not embed a public-key cryptography ratchet for offline-encryption-followed-by-online-key-recovery (the now-standard ransomware design), and does not ship with a default key-generation routine — instead, the operator supplies the AES-CTR encryption key at deployment time via a command-line argument, and the encryptor uses that key to encrypt files in place. This design choice has three operational implications. First, it constrains the family to operator-supervised manual deployments rather than affiliate-distributed automated campaigns, which matches Andariel's bespoke-state-sponsored operating model and is the principal architectural reason Maui cannot be commoditised the way LockBit or ALPHV are. Second, it produces no per-build key infrastructure (no on-encryptor key-pair generation, no operator-side key-recovery server, no automated decryptor-distribution capability), which simplifies the encryptor's footprint and reduces the EDR-detectable-behaviour surface but also means the operator must independently track and recover keys per victim if a decryptor is to be issued. Third, it makes Stairwell and Mandiant's reverse-engineering of the family unusually clean — the family's logical separation between the encryptor binary and the key-management plane is sharper than at any commodity RaaS family, and Stairwell's 2022 published analysis ([stairwell2022maui]) is the canonical technical reference for that architecture.

The family's role in the OAK-G09 Andariel monetization chain is the encryption-and-extortion node in a state-sponsored funding cycle distinct from both the OAK-G05 commercial-criminal cycle and the OAK-G01 / TraderTraitor crypto-industry-extraction cycle: Andariel deploys Maui (or successor families) against healthcare-and-DIB targets, collects ransom proceeds in cryptocurrency, launders those proceeds through OAK-T7-Tactic Techniques, and applies the proceeds to fund continued cyber-espionage operations whose intelligence-collection targets are downstream defence-industrial-base and energy-sector victims rather than additional ransom-paying victims. This ransomware-proceeds-fund-espionage operational pattern is documented in the Rim Jong Hyok indictment and is what makes Maui's OAK-S25 entry materially different in framing from OAK-S23 (LockBit, commercial extortion) and OAK-S24 (BlackCat / ALPHV, commercial extortion with affiliate ecosystem).

Observed examples

• U.S. healthcare-sector deployments (May 2021 onward). CISA AA22-187A documents at least two named incidents (a Kansas hospital case from May 2021 and a Colorado healthcare-provider case from April 2022) plus aggregated unnamed cases through 2022; the Kansas hospital paid approximately $100,000 in Bitcoin ransom which the FBI later seized and returned, an action publicly announced by Deputy Attorney General Lisa Monaco at the International Conference on Cyber Security in July 2022. Confirmed-grade attribution per CISA AA22-187A.
• Rim Jong Hyok indictment campaign cohort (2021–2023). The July 2024 DOJ indictment ([doj2024rimjonghyok]) documents a multi-year campaign in which Andariel deployed Maui (and successor families) against U.S. healthcare and DIB targets, collected and laundered approximately $1.84M in cryptocurrency ransom proceeds, and applied those proceeds to fund follow-on cyber-espionage operations against NASA, U.S. Air Force bases, defence contractors, and Korean / Taiwanese defence-industrial-base targets. The DOJ also announced a State Department $10M reward for information leading to apprehension of Rim Jong Hyok or other Andariel operatives. Confirmed-grade.
• OAK on-chain example surface. No OAK examples/ entry exists for Maui-binary-attributable deployments specifically as of v0.1; the OAK angle is the Andariel-cluster ransom-proceeds laundering tail (T7.001, T7.002, T8.002), where the on-chain forensic record is meaningfully cleaner than for commercial-criminal RaaS because Andariel's wallet-cluster reuse pattern is consistent with the broader DPRK-cluster T8.002 persistence and is documented in Chainalysis and TRM Labs DPRK-tracking work.

Detection / attribution signals

Defenders should treat Maui detection as low-volume-but-high-attribution because the operator-bespoke deployment model produces narrower campaign surfaces than commodity RaaS:

• Host-layer process-tree fingerprints — manual operator-supervised deployment with command-line-supplied AES key (the canonical Stairwell-documented invocation pattern in [stairwell2022maui]); no auto-key-generation routine on the encryptor binary itself; selective-encryption-target enumeration via operator-supplied target list rather than full-disk recursive walk; ransom-note delivery via the standard Andariel-cluster tooling rather than encryptor-embedded note-templates.
• Pre-encryption tradecraft — the broader Andariel intrusion-set characteristics (CISA AA22-321A, AA23-129A, and successor advisories) include exploitation of public-facing vulnerabilities (Log4j / Log4Shell extensively documented), credential theft via custom backdoor families (Dtrack, Maui-adjacent loaders), and lateral movement via legitimate-administrator tooling; the Maui deployment itself is the terminal phase of an Andariel-cluster intrusion rather than an entry vector.
• On-chain-layer signatures (the OAK-relevant signal) — Andariel-cluster ransom-payment wallets exhibit the broader DPRK-cluster wallet-cluster persistence pattern (OAK-T8.002) that is the strongest forensic-attribution signature for the operator cohort across encryptor families; the Rim Jong Hyok indictment's $1.84M aggregate ransom-proceeds figure was assembled by Chainalysis-and-FBI-led tracing across this wallet cluster; downstream routing has historically run through Sinbad pre-takedown and through Bitcoin-to-other-asset conversions at non-KYC and weak-KYC venues.
• CTI vendor coverage — Stairwell (canonical 2022 technical reverse-engineering, [stairwell2022maui]), Mandiant (Andariel-cluster tracking, intrusion-set documentation), Microsoft Threat Intelligence (Plutonium / DEV-0530 / Onyx Sleet naming for the same operator cohort), CrowdStrike (Stonefly / Silent Chollima naming and continuous tracking), Recorded Future (Insikt Group Andariel-cluster reporting), Chainalysis and TRM Labs (DPRK-cluster wallet-tracking work that subsumes Andariel-attributable proceeds).

Note: omit specific file hashes from this entry. Defenders should consume current IOCs from CISA AA22-187A and the Stairwell published analysis; the canonical decryptor-and-prevention guidance for Maui specifically is in CISA AA22-187A.

Citations

• [cisaaa22187a] — CISA / FBI / Treasury joint advisory AA22-187A, July 6, 2022, "North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector." Primary U.S.-government confirmed-grade anchor for the family. (NEW citation — see summary.)
• [doj2024rimjonghyok] — DOJ unsealed indictment of Andariel operative Rim Jong Hyok, July 25, 2024, naming Maui as the deployed encryptor in the U.S. healthcare-sector campaign and documenting the ~$1.84M aggregate ransom-proceeds figure. (NEW citation — see summary.)
• [stairwell2022maui] — Stairwell technical reverse-engineering of Maui ransomware, July 2022; canonical reference for the operator-supplied-AES-key architecture. (NEW citation — see summary.)
• [mandiantandariel2022] — Mandiant Andariel intrusion-set documentation. (NEW citation — see summary.)
• [microsoftonyxsleet2022] — Microsoft Threat Intelligence DEV-0530 / Onyx Sleet (Plutonium-renamed) analysis covering the Andariel-cluster ransomware operations. (NEW citation — see summary.)
• [chainalysisdprkmaui2024] — Chainalysis tracking of Andariel-attributable ransom-proceeds laundering routes. (NEW citation — see summary.)
• [chainalysis2024dprk] — DPRK-attributed cryptocurrency-theft and ransom-proceeds aggregate context (also cited in OAK-G01 and OAK-S08).

Discussion

On lineage. Maui sits within the DPRK / Andariel-cluster ransomware lineage, which is operationally and architecturally distinct from the broader Lazarus / APT38 / TraderTraitor crypto-industry-targeting lineage even though both sub-clusters operate under the DPRK Reconnaissance General Bureau umbrella. Predecessors: Andariel-cluster wiper-and-destructive-malware activity from approximately 2014 onward (the Sony Pictures cohort and Operation Blockbuster lineage), with a ransomware pivot circa 2020–2021 that produced Maui as the first publicly-named DPRK-attributed financially-motivated ransomware family. Successors / contemporaries: H0lyGh0st (PLUTONIUM / DEV-0530-attributed family, July 2022 Microsoft analysis), SiennaPurple / SiennaBlue (Microsoft Onyx Sleet successor families), and unnamed Andariel-attributed encryptors observed in 2023–2024 healthcare and DIB intrusions per Mandiant tracking. The family is therefore one node in a continuing Andariel-cluster ransomware program rather than the program itself.

On predecessors and successors. Maui's operational predecessors at the Andariel-cluster level are the destructive-wiper families (KillDisk-class) deployed in earlier non-financially-motivated DPRK operations; the family's principal successor is the cluster's continued ransomware deployment under rotated naming with similar operator-supplied-key architectural patterns. Mapping Andariel-cluster encryptor family rotation across 2021–2025 is an active CTI-frontier problem and is the principal reason the OAK-S25 active-status field reads "dormant" rather than "sunset."

On the OAK Software-vs-Group split. OAK-S25 (this entry) is the Maui encryptor codebase — the specific Andariel-deployed Windows ransomware named by CISA AA22-187A. OAK-G09 (drafted in parallel) is the Andariel operator cluster — the DPRK-RGB-attributed sub-unit including Rim Jong Hyok and the broader operator team. The split is encryptor-family-vs-operator-cluster in the same sense as OAK-S23 / OAK-G05 (LockBit) and OAK-S24 / OAK-G10 (ALPHV); the principal asymmetry from those entries is that Andariel is a state-sponsored cluster running multiple successive encryptor families rather than a commercial-criminal cluster running a single brand across multiple versions, so the Software-vs-Group cardinality is many-to-one (OAK-G09 will eventually accumulate multiple OAK-Sxx entries as Andariel-cluster encryptor families are documented) rather than one-to-one.

On the state-sponsored-financially-motivated framing. Maui is the canonical worked example for the state-sponsored ransomware deployed against civilian-critical-infrastructure to fund follow-on espionage operational pattern. This pattern is structurally distinct from OAK-G05 / LockBit (commercial-criminal extortion, no espionage tail), from OAK-G01 / TraderTraitor (state-sponsored direct-extraction from crypto-industry firms, no ransomware deployment), and from generic-Lazarus-financial-cyber-crime framings that conflate the sub-clusters. The Rim Jong Hyok indictment's central narrative — ransomware proceeds against U.S. hospitals funded subsequent cyber-espionage against U.S. defence-industrial-base and NASA targets — is what defenders should anchor the family's strategic-significance reading on; the per-incident on-chain laundering surface is downstream of that strategic reading and follows the conventional DPRK-cluster T7-and-T8 patterns.