Ransomware strains such as Maze, Ryuk and BlackCat have increasingly been part of FIN7's playbook in recent years, Mandiant says.

It's the latest indication that Maze, Egregor and other groups may be run by a relatively small number of people.

New research suggests the ransomware ecosystem is smaller than the number of attacks would have you believe.

It's all about economics.

"They’re snooping around” for balance sheets and other financial data, a DHS official says.

Maze is but one of a series of ransomware affiliates that like to target IT services companies.

Like others involved in ransomware, the people behind Maze are not one group but a series of distinct teams with specialties.

Forensic data suggests that Maze infrastructure was used in the attack.

Officials have tied at least some of the Maze attacks to a group known only as TA-2101.