Zeppelin

About Zeppelin.

Zeppelin is a Ransomware threat actor operating as a Ransomware-as-a-Service (RaaS) platform, primarily motivated by financial-gain. The group emerged in November 2019 as a highly targeted variant of the Delphi-based Vega (VegaLocker) malware family. Zeppelin mainly targets organizations across Europe, the United States, and Canada, with a particular focus on healthcare and medical industries, while deliberately avoiding systems located in Russia and other Commonwealth of Independent States (CIS) countries. Victims also include defense contractors, educational institutions, manufacturers, and technology companies. Zeppelin actors employ double extortion tactics, exfiltrating sensitive data prior to encryption and threatening to publish or sell it if ransom demands are not met. Initial access is commonly achieved through RDP exploitation, SonicWall firewall vulnerabilities, and phishing campaigns. Prior to ransomware deployment, actors spend one to two weeks mapping victim networks to identify data enclaves, including cloud storage and network backups. Ransom demands are requested in Bitcoin and range from several thousand dollars to over one million dollars.