Loading threat actor…
Zeppelin is a ransomware operation active from 2019 until its disruption in 2022. It conducted financially motivated attacks against organizations and individuals in the United States and other countries, using data encryption together with data theft and extortion. Reporting and law-enforcement actions tie the operation to Ianis Aleksandrovich Antropenko, a Russian national living in California who was accused and later reported to have pleaded guilty in connection with leading the group and laundering ransomware proceeds. Zeppelin has also been referenced as part of the broader ransomware affiliate ecosystem and as a user of cryptocurrency laundering services to process ransom payments. Zeppelin’s operations combined initial compromise of victim environments with post-compromise encryption, exfiltration of victim data, and extortion. Its tradecraft therefore aligns with initial access, post-exploitation, persistence, defense evasion, exfiltration, and extortion behaviors typical of mature ransomware crews. The group’s monetization model included laundering proceeds through cryptocurrency mixing and exchange mechanisms. Known aliases include Zeppelin and Zeppelin Ransomware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned in passing as a ransomware operation that has run an affiliate program.
Ransomware operation; content references a leader pleading guilty and involvement in ransomware attacks prior to moving to the US.
Ransomware operations over multiple years (2018–2022 timeframe) targeting dozens of victims; leadership tied to a Russian national with cryptocurrency seizures linked to proceeds.
Referenced as a ransomware gang that used the Cryptomixer service to launder ransom payments.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.