Loading story…
CISA and the FBI issued a joint #StopRansomware advisory on Zeppelin ransomware, a Delphi-based derivative of the Vega malware family that has operated as a ransomware-as-a-service offering. The agencies said Zeppelin actors targeted businesses and critical infrastructure organizations from 2019 through at least mid-2022, with notable impact on healthcare and medical entities. Victims were often compromised through exposed or exploited RDP, exploitation of SonicWall firewall vulnerabilities, and phishing campaigns.
After gaining access, Zeppelin operators typically spent one to two weeks conducting network enumeration and data exfiltration before encrypting systems. The malware commonly appends a randomized nine-digit hexadecimal extension to encrypted files and drops a ransom note, and some organizations were struck multiple times within the same network and needed several distinct decryption keys. The advisory urged defenders to strengthen MFA, patch internet-facing systems, segment networks, deploy EDR, enforce least privilege, and maintain offline, immutable backups, while reiterating that paying a ransom does not guarantee recovery.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
The FBI and CISA released joint #StopRansomware advisory AA22-223A on Zeppelin ransomware, describing its tactics, victimology, indicators of compromise, and recommended mitigations.
The FBI reported identifying Zeppelin ransomware variants in investigations as recently as June 21, 2022, indicating continued operational activity by the threat actors.
From 2019, Zeppelin ransomware actors targeted businesses and critical infrastructure organizations, including defense contractors, educational institutions, manufacturers, technology companies, and especially healthcare and medical entities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 144 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI, CISA, and MS-ISAC issued a joint **#StopRansomware** advisory warning that the **Vice Society** intrusion and extortion group has disproportionately targeted the education sector, particularly **K-12 schools**. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses **double extortion**, stealing data before encrypting systems and threatening to publish it if victims refuse to pay. Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including **Hello Kitty/Five Hands** and **Zeppelin**. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as **SystemBC**, **PowerShell Empire**, and **Cobalt Strike**, while escalating privileges through **PrintNightmare** flaws `CVE-2021-1675` and `CVE-2021-34527`. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Jun 29, 2026
Zscaler ThreatLabz reported that a real-world ransomware campaign disproportionately compromised employees with business authority rather than only users with obvious technical privilege. In a one-month sample tied to a single ransomware operation, researchers identified **351 victims across 334 organizations**, with **62%** of victims holding manager-level titles or higher. The campaign was linked to a group known for gaining initial access, stealing large volumes of corporate data, and selectively encrypting critical systems. The victim set was concentrated in functions that can unlock sensitive business processes: roughly **75%** worked in accounting and finance, sales, operations, human resources, or marketing, while **50%** were in industrials or information technology. ThreatLabz said these roles can expose payments, contracts, vendor relationships, sensitive records, and cross-business communications that help attackers move laterally and increase extortion pressure. The researchers said organizations should tighten external collaboration controls, strengthen impersonation-focused training, deploy inline network and endpoint detection, monitor for compromise, enforce least privilege, and apply **Zero Trust** segmentation.
Aug 11, 2026
Attackers used the low-cost **Philadelphia** ransomware to run targeted campaigns against healthcare institutions and other organizations in the same city, delivering malware through spoofed internal-looking emails themed around patients and linked via `bit.do` URLs. The operation stood out because ransom notes were customized with victim organization names, demanded **15 Bitcoin**, and threatened to delete files on a timed schedule, showing a level of personalization more often associated with higher-end ransomware operations. Proofpoint reported that Philadelphia supported multiple delivery paths, including zipped executables linked from emails, macro-enabled Word documents that launched PowerShell, bundled installers on keygen and cracking sites, and distribution through the **Sundown** and **RIG** exploit kits. Its server-side configuration let operators set ransom amounts, Bitcoin addresses, victim IDs, and payment confirmation requirements, underscoring how commodity ransomware had evolved into a flexible platform for more tailored and aggressive attacks.
Aug 14, 2026