The FBI, CISA, and Treasury reported that North Korean state-sponsored actors had used Maui ransomware since at least May 2021 against Healthcare and Public Health sector organizations. The intrusions encrypted servers supporting electronic health records, diagnostics, imaging, and intranet services, causing prolonged disruption in some cases while the initial access vectors remained unknown. The advisory describes Maui as a manually executed encryption binary operated through command-line activity, using AES, RSA, and XOR routines with local key and log artifacts that operators likely exfiltrate for decryption workflows. The notice also provides Maui hash indicators and warns healthcare and other critical-infrastructure defenders to mitigate ransomware risk and report incidents rather than paying ransoms.