Digital forensic of Maze ransomware: A case of electricity distributor enterprise in ASEAN

Due to the Coronavirus pandemic (COVID-19) throughout 2020-22, remote working has played an important part in organizations, businesses, and agencies worldwide. This situation makes the various cybersecurity threats the Internet poses, especially ransomware. Ransomware will remain the top cybersecurity threat, and the energy sector is the prime target. Previously, research papers only focused on the analytical and protection frameworks. These papers rarely provide real evidence and detailed digital forensics. Interestingly, the ransomware gangs developed new methods but still used similar attack patterns. The authors envisage that a precise understanding of the ransomware attack characteristics is a starting point for the correct detection process. This paper presents a true case study demonstrating the actual occurrence of digital forensics and in-depth technical details of the attacks within the energy sector. The significant attack patterns, which have never been emphasized in research papers, can be proposed for the two loops. The results led to a novel ransomware attack matrix with two loop patterns (dwell time factor) applicable to other ransomware gangs for the detection stage of the NIST.