What you need to know about ransomware threat Zeppelin

Dr Darren Williams, CEO and Founder of ransomware specialist Blackfog, looks at how cybercriminals are using Zeppelin to attack hybrid working companies.

The Federal Bureau of Investigation (FBI) in conjunction with the Cybersecurity and Infrastructure Security Agency (CISA) have issued a new warning on a strain of ransomware targeting companies.

Zeppelin is a high-tech attempt to hold companies' data hostage and the hackers behind it are demanding as much as a million dollars to get data back.

The FBI and CISA warn the targets in this attack are companies with employees working from home.

"Zeppelin ransomware has been particularly interested in targeting the health care industries," said FBI Agent Elvis Chan. "Attackers are looking for cash cows that have weak cybersecurity."

What is Zeppelin?

Dr Darren Williams, CEO and Founder of ransomware specialists Blackfog, offers the following unique insight: “Zeppelin ransomware, a fairly well-known malware strain has been in known use since 2019, often to target a wide range of businesses and critical infrastructure organisations. Zeppelin actors have been known to request ransom payments in Bitcoin, with initial amounts ranging from several thousand dollars to over a million dollars.

"Zeppelin’s unique attack path is such that the FBI have observed the attackers executing the malware multiple times in the network, leaving a great big sting on the victim, who needs multiple unique decryption keys to combat the attack.

 "Attacks on hybrid working companies are nothing new, however it is crucial that employees remember they play a part in protecting themselves and the employer, too."

How to protect yourself from Zeppelin

Williams says: "Attacks from vectors such as Zeppelin often start with a simple phishing email - employers must ensure they educate and remind their employees on cyber security best practices, to minimise attack risk. Standard, good cyber hygiene practice is essential here: remembering to regularly change passwords and use MFA as a basic practice. That said, if a threat actor wants to find their way in, they will! What matters is the data they were able to obtain and leave with.

"Most cybercriminal gangs aim for extortion – organisations should also consider anti-data exfiltration to block the attacker and prevent data from being exfiltrated.”

Share

Featured Articles

IT and OT security with Ilan Barda, CEO of Radiflow

Cyber Magazine speaks with Radiflow’s CEO, Ilan Barda, about converging IT and OT and how leaders can better protect businesses from cybersecurity threats

QR ‘Quishing’ scams: Do you know the risks?

QR code scams, or Quishing scams, are rising and pose a threat to both private users and businesses as cyberattacks move towards mobile devices

Zero Trust Segmentation with Illumio’s Raghu Nandakumara

Head of Industry Solutions at Illumio, Raghu Nandakumara, offers insight into the proposed ban on ransom payments and how businesses can utilise Zero Trust

Is the password dead? Legacy technology prevents the shift

Network Security

Fake Bard AI malware: Google seeks to uncover cybercriminals

Technology & AI

Gartner report highlights threat of supply chain attacks

Cyber Security