ZeppelinMalware
Zeppelin is a ransomware written in Delphi and sold a as-a-service. The Cylance research team notes that it is a clear evolution of the known VegaLocker, but they assessed it as a new family becaue of additionally developed modules that makes Zeppelin much more configurable than Vegalocker. There are executable variants of type DLL and EXE.From MISP Galaxy
Last reported 11 months ago, by Huntress2 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1003.003NTDS
“Following persistence establishment, the threat actor used ntdsutil to dump the NTDS.dit database (T1003.003), then compressed it into a ZIP archive, likely staged for exfiltration.”
- T1003.006DCSync
“Subsequently, the threat actor leveraged their existing Domain Admin privileges to perform a DCSync attack.”
- T1021.001Remote Desktop Protocol
“Besides Cobalt Strike’s capabilities to run the Beacon stagers on remote hosts, the attackers used Remote Desktop Protocol to move laterally.”
- T1021.006Windows Remote Management
“…and 54 minutes after the initial JavaScript execution and reconnaissance activity, the threat actor moved laterally via WinRM (Windows Remote Management) to the Domain Controller.”
- T1053.005Scheduled Task
“Moved from scheduled tasks to Startup folder persistence mechanism and still using Windows 8.3 short filenames”
- T1547.001Registry Run Keys / Startup Folder
“…the initial JavaScript file, approximately 10-20 minutes later, two persistence mechanisms would be created leveraging Startup folder (T1547.001).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Gootloader | Threat Detection Overview“…2022 and delivers different ransomware families, including Rhysida (commonly observed in Gootloader post-intrusion activity), BlackCat, Zeppelin, and Quantum Locker.”
-
Connecting the Bots“…citor’s deep interest in Big Game Hunting is further supported by Jason Reaves‘s earlier findings about Hancitor’s association with the Zeppelin ransomware.”
Indicators in its reports
named in the reports above- cf44aa11a17b3dad…c9d3d183482ain 1 report
- 103.253.42[.]91in 1 report
- 91.236.230[.]134in 1 report
- 213.232.236[.]138in 1 report
- 146.19.49[.]177in 1 report
- 39d980851be1e111…5435c78f7049in 1 report
- hxxps://cortinaspraga[.]com/in 1 report
- cortinaspraga[.]comin 1 report
- hxxp://cookcountyjudges[.]org/in 1 report
- cookcountyjudges[.]orgin 1 report
- hxxps://x.fybw[.]org/in 1 report
- x.fybw[.]orgin 1 report
- hxxps://jungutah[.]com/in 1 report
- jungutah[.]comin 1 report
- hxxps://influenceimmo[.]com/in 1 report
- influenceimmo[.]comin 1 report
- hxxps://tokyocheapo[.]com/in 1 report
- tokyocheapo[.]comin 1 report
- hxxps://espressonisten[.]de/in 1 report
- espressonisten[.]dein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.