Ransomware continues to plague businesses around the world, encrypting valuable data and demanding huge sums to decrypt it. The latest variant making waves is Zeppelin ransomware, which researchers first spotted in November 2019. I‘ve analyzed this new threat and distilled key facts every organization needs to know about defending against it.
Understanding Ransomware Basics
Before diving into Zeppelin specifically, let‘s review some ransomware fundamentals…
Ransomware is a type of malicious software that encrypts files on a device or network, preventing the rightful user from accessing their data. The attackers demand a ransom payment in cryptocurrency and promise to send a decryption key if paid. Some estimates show over 2000 ransomware attacks occur every day, targeting healthcare, education, government and commercial sectors.
Attackers often gain initial entry through phishing emails containing infected attachments or links. Once inside the network, ransomware can spread rapidly to connected systems and backup devices. Without the decryption key, restoring encrypted files is almost impossible according to experts.
Inside Zeppelin Ransomware
Now focusing on Zeppelin, researchers first detected it in early November 2019. Zeppelin appears to be an updated version of the Vega ransomware family. However, Zeppelin has some key differences:
- Targets Western Europe and United States rather than Russia/CIS
- Avoids infecting Russian systems
- Strong focus on healthcare and IT sectors
This shift led analysts from BlackBerry Cylance to hypothesize Zeppelin may come from a different developer group than earlier Vega variants.
Infection Process
The initial infection vector for Zeppelin remains unclear. Possible entry points analysts proposed include:
- Phishing emails with infected macros or links
- Brute force attacks on RDP logins
- Exploiting unpatched vulnerabilities
Once inside the system, Zeppelin appears to terminate key processes like database and backup services to disable defenses. It then starts encrypting a wide array of user files.
Encryption & Ransom Process
The encryption scheme matches earlier Vega ransomware. RSA + AES encryption with a random key generated per file. Zeppelin appends the .zeppelin extension to encrypted files.
After encryption completes, Zeppelin displays a ransom note demanding payment to receive the decryption software and keys. The initial ransom demands ranged from $2500 to $3500 in Bitcoin.
Attempts to Recover Files
Like most modern ransomware, Zeppelin utilizes strong encryption making decryption without the attackers‘ software virtually impossible. In limited cases, researchers from Kaspersky found Zeppelin may Leave remnants of encryption keys on infected hosts. But this provides little help in most incidents.
Who May Be Behind Zeppelin?
Pinpointing the precise hackers responsible for ransomware strains proves exceptionally difficult. However, the geographic targeting of Zeppelin provides some clues…
Leading Suspects
- Russian Cybercriminals: The ransomware black market originating from Russia remains highly active. Zeppelin‘s code resemblance to earlier Russian ransomwares suggests possible Russian authorship.
- State Sponsors: Some analysts propose state-sponsored groups from nations like North Korea or Iran could be unleashing ransomwares to raise funds while inflicting damage on adversaries.
- Copycats: Successful ransomware code leaks frequently. Less sophisticated groups often simply repackage and re-release code under a new name.
Follow the Money
Attempting to track ransom payments also hits dead ends. The Bitcoin wallets used cannot be definitively tied to any known group or nation. However, an estimate from Coveware found the average Zeppelin payment sat around $65,000 – much higher than typical ransomware payments. This indicates the attackers specifically target organizations with high ability and willingness to pay top dollar for decryption.
Industries and Regions at Risk
Based on early attacks, Zeppelin appears focused on Western Europe and North America, consistent with its coding to avoid Russian-associated systems. Within those regions, health care and technology companies face the highest risk.
Specific verticals analysts cited as prime targets include:
- Hospitals & Medical Centers
- Insurance Providers
- IT & Technology Services
- Educational Institutions
- Financial Firms
The dependence these industries have on access to data, plus their ability to pay significant ransoms, make them attractive targets for groups deploying ransomware-as-a-service.
The Damage Zeppelin Can Inflict
Like most ransomware strains, Zeppelin can produce devastating outcomes for impacted organizations by:
- Halting Critical Operations: Encrypting databases and shared drives brings business workflows to a standstill.
- Crushing Productivity: Employees sit idle unable to access central systems and data.
- Destroying Data: Permanently losing access to intellectual property, financial records, patient health data, and more.
- Harming Customers: The inability to serve clients/patients/customers destroys goodwill.
- Generating Massive Costs: Expenses from network recovery, legal liabilities, ransom payments and lost revenue.
One example of the havoc caused by ransomware comes from an August 2019 attack on over 400 dental practices in the United States by Sodinokibi ransomware. It left dentists unable to access patient records or appointment data for weeks – unable to operate and serve customers. This one attack demonstrates the wide-reaching impact ransomware unleashes on businesses.
Defending Your Organization from Zeppelin
Preparing defenses before an attack provides by far the best chance of avoiding severe Zeppelin impacts. Use this comprehensive checklist to harden your ransomware protections:
Backup Diligently
- Maintain recent backups offline and immutable to prevent encryption or deletion
- Test backup recovery processes regularly
- Ensure all mission critical data gets backed up
Train Employees
- Educate staff how to identify social engineering and phishing threats
- Avoid clicking links or opening attachments from unknown sources
- Report suspicious security events
Secure Endpoints
- Patch and update software/OS promptly
- Install reputable endpoint anti-virus to detect ransomware
- Utilize whitelisting to limit unauthorized applications
- Minimize access permissions for standard users
Manage Access
- Require strong multi-factor authentication
- Disable unused remote access pathways like RDP
- Seek to minimize exposed services and data
Add Layers
- Deploy email security and web filtering to block threats
- Segment networks to control lateral movement
- Design with zero trust model instead of VPN access
Test Defenses
- Conduct phishing simulations to improve reactions
- Hire red teams to probe for weaknesses
- Learn and budget for effective security
Recovering When Zeppelin Strikes
Despite best efforts, some percentage of businesses will still fall prey to attacks like Zeppelin. When this occurs, respond using procedures like:
Disconnect and Contain
- Isolate infected devices immediately
- Stop spread by shutting down links between segments
- Work offline when assessing and cleaning systems
Notify Partners
- Inform possible downstream impacted companies
- Report to law enforcement to aid investigations
- Consult legal counsel for next steps
Evaluate Restoration Options
- Attempt recovery from recent offline backups first
- Research possibilities of decryption without paying
- Negotiate payment if data return holds worth
Note paying the ransom demands should only be considered an absolute last resort given the criminal nature of the attackers. Plus, even with payment, recovery of all systems and data often proves impossible.
What Does the Future Hold for Zeppelin?
Predicting the path of ransomware families presents many challenges. However, we can extrapolate some educated guesses regarding Zeppelin from wider trends…
Hope for Decryption Tools?
In some ransomware campaigns, cybersecurity companies or law enforcement release free decryption tools after enough attacks occur. But for Zeppelin, experts consider this unlikely for now due to its relatively limited distribution and technical sophistication.
Expanding Target List
Successful ransomware groups tend to expand the industry and geographic scope of targets over time. I‘d expect Zeppelin attacks to spread out from the initial concentration on Western healthcare and tech if ransom payments remain profitable.
Forking the Code
Skilled ransomware developers frequently take an existing code base and tweak it to produce "forked" variants. This helps avoid security products tuned to previous signatures. The Zeppelin code will almost undoubtedly get reused and rebranded into fresh ransomware strains.
Evolving Tactics
Attackers constantly shift their initial intrusion vectors, propagation methods, evasion techniques and payment systems. Zeppelin‘s operators will certainly incorporate new exploitable vulnerabilities, social engineering schemes, deployment automation, and money laundering avenues over time.
In summary – don‘t expect the Zeppelin ransomware danger to disappear soon. But armed with the right intelligence and defenses, organizations can effectively face down this threat.
Key Takeaways on the Zeppelin Menace
For quick reference, here are top facts to know regarding Zeppelin:
- Zeppelin presents the latest evolution of the Vega ransomware family – now targeting Western regions
- Healthcare and technology sectors face highest current risk
- Phishing, RDP attacks or exploits could provide initial infection vector
- RSA + AES encryption leaves little decryption possibility without payment
- Preventing attacks centers on backups, patches, endpoints, access controls and user security awareness
- Have an incident response plan ready for containment, restoration and notification if infected
- Expect the Zeppelin threat to continue evolving in sophistication, scope and size
Share your own experience or advice dealing with ransomware via the comments below!
Sources
[1] https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-20-billion-usd-by-2021/
[2] https://www.blackberry.com/us/en/forms/resources/threat-spotlight-zeppelin-ransomware
[3] https://securelist.com/zeppelin-ransomware/95215/
[4] https://www.coveware.com/blog
[5] https://nakedsecurity.sophos.com/2019/08/20/hundreds-of-us-dental-offices-crippled-by-sodinokibi-ransomware-attack/
