Flash Notice: Zeppelin Ransomware Targets Healthcare

August 18, 2022

Overview of of zeppelin ransomware

Zeppelin ransomware is targeting the healthcare sector with a new campaign that involves multi-encryption tactics. The threat actors behind the ransomware gain access to victims’ networks via RDP exploitation, SonicWall firewall vulnerabilities, and phishing campaigns.

Prior to gaining access to their victim’s network, Zeppelins’ actors spend up to two weeks mapping or enumerating their victim’s network to identify data enclaves, such as cloud storage and backups. Additionally, Zeppelins’ actors exfiltrate sensitive data files to sell or publish prior to encryption. The exfiltrated data is used to blackmail the victim if they refuse to pay the demanded ransom. Also, the FBI has observed the malware being executed several times within a victim’s network, resulting in the victim needing several unique decryption keys.

CISA and the FBI warned that Zeppelin ransomware is targeting critical infrastructure organizations as well as organizations within manufacturing, technology, defense, and education. Zeppelins’ operators are known to leave ransom notes on their victims’ systems, requesting ransom payments in Bitcoin. The ransom amounts range from thousands of dollars to over a million dollars.

According to CISA, Zeppelin ransomware is a derivative of the Delphi-based Vega malware family and operates as a Ransomware-as-a-Service (RaaS). Avertium recommends that you implement the suggested recommendations to reduce the impact of a ransomware incident from Zeppelin.

How Avertium is Protecting Our Customers:

Avertium recommends utilizing our service for DFIR (Digital Forensics and Incident Response) to help you rapidly assess, contain, eradicate, and recover from a security incident.
Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you will have no more blind spots, weak links, or fire drills.
Fusion MXDR is the first MDR offering that fuses together all aspects of security operations into a living, breathing, and threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts.

Avertium offers Zero Trust Architecture, like AppGate, to stop malware lateral movement.

Avertium's recommendations

The FBI, CISA, and Avertium recommend the following mitigations to reduce the risk of an attack by Zeppelin ransomware:

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).

Require all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to comply with National Institute for Standards and Technology (NIST) standards for developing and managing password policies.

- Use longer passwords consisting of at least eight characters and no more than 64 characters in length
- Store passwords in hashed format using industry-recognized password managers
- Add password user “salts” to shared login credentials
- Avoid reusing passwords

- Implement multiple failed login attempt account lockouts
- Disable password “hints”
- Refrain from requiring password changes more frequently than once per year. Note: NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.
- Require administrator credentials to install software.