CISA Alert AA22-223A – #StopRansomware: Zeppelin Ransomware. [CISA Cybersecurity Alerts}

CyberWire Daily

N2K Networks, Inc.

Daily News, Tech News, News, Technology

4.6 • 1K Ratings

🗓️ 11 August 2022

⏱️ 3 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

Zeppelin ransomware functions as a ransomware-as-a-service (RaaS), and since 2019, actors have used this malware to target a wide range of businesses and critical infrastructure organizations. Actors use remote desktop protocol (RDP), SonicWall firewall vulnerabilities, and phishing campaigns to gain initial access to victim networks and then deploy Zeppelin ransomware to encrypt victims’ files. AA22-223A Alert, Technical Details, and Mitigations Zeppelin malware YARA signature What is Zeppelin Ransomware? Steps to Prepare, Respond, and Prevent Infection Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts. No-cost cyber hygiene services: Cyber Hygiene Services and Ransomware Readiness Assessment. This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed TTPs and IOCs to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Transcript

Click on a timestamp to play from that location

0:00.0	You're listening to the CyberWire Network, powered by N2K.
0:07.0	This is a SISA Cybersecurity Alert.
0:14.0	ID number Alpha Alpha 22 TAC 223 Alpha.
0:20.0	Original release releasing this joint advisory to disseminate known Zeppelin Ransom
0:33.0	Ransomware IOCs and TTPs associated with ransomware
0:36.3	variants identified through FBI investigations as
0:38.9	recently as June 21st, 2022. Zeppelin Ransomware is a derivative of the Delphi-based Vega Malware
0:45.8	family and functions as a ransomware as a service.
0:49.8	From 2019 through June 2022, cyber actors have used this malware to target a wider range of businesses
0:55.6	and critical infrastructure organizations, including defense contractors, educational institutions,
1:01.0	manufacturers, technology companies, and organizations in the health care and
1:04.8	medical industries.
1:05.8	Zeppelin actors have been known to request ransom payments in Bitcoin, with initial amounts
1:10.3	ranging from several thousand dollars to over a million dollars.
1:14.3	Zeppelin actors gain access to victim networks via RDP exploitation, exploiting
1:19.6	Sonic Wall firewall vulnerabilities, and fishing campaigns.
1:24.0	Prior to deploying Zeppelin ransomware, actors spend one to two weeks mapping the victim network to identify data enclaves, including cloud storage and network backups.
1:34.6	Zeppelin actors can deploy Zeppelin ransomware as a dot DLL or dot-E-X-E file or contained within a
1:40.4	power shell loader. Prior to encryption, Zeppelin actors exfiltrate sensitive company data to sell or publish in the event the victim refuses to pay the ransom.
1:50.0	The alert documentation linked in the show notes includes indicators of compromise, a full mitre attack mapping for this threat activity, recommended mitigation actions, and detection techniques for Zeppelin malware.
2:02.0	This joint Cyber cybersecurity advisory is part of an ongoing hashtag stop ransomware effort
2:07.0	to publish advisories for network defenders that detail various ransomware variants and
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.