FBI: Zeppelin Ransomware May Encrypt Devices Multiple Times in Attacks - Binary Defense

Threat Watch

Threat Watch FBI: Zeppelin Ransomware May Encrypt Devices Multiple Times in Attacks

FBI: Zeppelin Ransomware May Encrypt Devices Multiple Times in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) warned US organizations that attackers deploying Zeppelin ransomware might encrypt their files multiple times. Zeppelin ransomware is a derivative of the Delphi-based Vega malware family and functions as a Ransomware-as-a-Service (RaaS). From 2019 through at least June 2022, actors have used this malware to target a wide range of businesses and critical infrastructure organizations, including defense contractors, educational institutions, manufacturers, technology companies, and especially organizations in the healthcare and medical industries. Zeppelin actors have been known to request ransom payments in Bitcoin, with initial amounts ranging from several thousand dollars to over a million dollars. Zeppelin actors gain access to victim networks via RDP exploitation, exploiting SonicWall firewall vulnerabilities, and phishing campaigns. Prior to deploying Zeppelin ransomware, actors spend one to two weeks mapping or enumerating the victim network to identify data enclaves, including cloud storage and network backups. Zeppelin actors can deploy Zeppelin ransomware as a .dll or .exe file or contained within a PowerShell loader.

See the full advisory here: https://www.cisa.gov/uscert/ncas/alerts/aa22-223a

ANALYST NOTES

The FBI and CISA recommend the following mitigations to reduce the risk of compromise by Zeppelin ransomware:

• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).
• Require all accounts with password logins to comply with National Institute for Standards and Technology (NIST) standards.
• Require multifactor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
• Keep all operating systems, software, and firmware up to date.
• Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.
• Install, regularly update, and enable real time detection for antivirus software on all hosts.
• Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.
• Disable unused ports.
• Consider adding an email banner to emails received from outside your organization.
• Disable hyperlinks in received emails.
• Implement time-based access for accounts set at the admin level and higher.
• Disable command-line and scripting activities and permissions.
• Maintain offline backups of data.
• Ensure all backup data is encrypted.

https://www.bleepingcomputer.com/news/security/fbi-zeppelin-ransomware-may-encrypt-devices-multiple-times-in-attacks/