Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareRansomwareUsed by 1 actorExploits 1 CVE

ZEPPELIN

Zeppelin is a ransomware family active in attacks observed between at least 2019 and 2022. The provided content links Zeppelin to a ransomware operation allegedly led by Russian national Ianis Aleksandrovich Antropenko, who pleaded guilty to leading the Zeppelin ransomware group and admitted targeting more than 50 victims worldwide during that period. Reporting in the content states Zeppelin targeted individuals, businesses, and organizations in the United States and other parts of the world.

The malware is repeatedly described as a third-party locker used by other threat actors rather than being exclusive to a single intrusion set. Most notably, Vice Society/Vanilla Tempest/DEV-0832 is repeatedly reported to have deployed Zeppelin in its intrusions, alongside other ransomware families such as Hello Kitty/Five Hands, BlackCat, Quantum Locker, Rhysida, and later INC and Ink. In Vice Society-related reporting, Zeppelin was used in campaigns disproportionately affecting the education sector, especially K-12 institutions, and also in healthcare and manufacturing intrusions. Initial access associated with those intrusions included exploitation of internet-facing applications, compromised valid accounts, abuse of RDP, and exploitation of PrintNightmare vulnerabilities CVE-2021-1675 and CVE-2021-34527. Vice Society operations involving Zeppelin also included double extortion, with data exfiltration prior to encryption.

A concrete Vice Society-related observation in the content notes deployment of Zeppelin ransomware on November 12, 2022 at path C:\mnt\smile.exe. The same reporting describes surrounding attacker activity including use of Cobalt Strike, Rubeus, Mimikatz, PowerShell, disabling Windows Defender protections, creation of administrator accounts, termination of security and business-critical processes, exfiltration of files, deletion of shadow copies, and impact to virtual servers such as Microsoft Hyper-V. The content also notes infrastructure overlap reporting in which IP address 34.41.139.193 was associated with multiple malware families including Zeppelin ransomware, though no direct operational conclusion beyond shared infrastructure is provided.

Additional content references place Zeppelin in broader ransomware ecosystem relationships and overlaps. It is mentioned as one of the ransomware strains cycled through by Vice Society/Vanilla Tempest over time, and one report notes overlaps between COLDDRAW and Zeppelin, with Zeppelin reportedly distributed via CHANITOR. Another report states Zeppelin samples were found among tooling recovered during a Netwalker-related investigation. High-confidence indicators directly mentioned in the content for Zeppelin itself are limited, but include the observed file path C:\mnt\smile.exe and the shared infrastructure reference to 34.41.139.193.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2021-34527PrintNightmareExploited in the wild

The TTPs are nothing new. They include initial network access through compromised credentials, exploitation of known vulnerabilities (e.g., PrintNightmare)

via sentinelone labssentinelone.com
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Vanilla Tempest

Vice Society was observed deploying INC ransomware against the health care industry; this group has a long-standing habit of cycling through third-party payloads such as BlackCat, Rhysida, Hello Kitty, Zeppelin, and Quantum Locker.

via acronisacronis.com
MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques
T1583.001DomainsEvidence1

MITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: Domains T1583.001 joscramp[.]top + 7 co-hosted domains via Dynadot

T1583.004ServerEvidence1

MITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: Server T1583.004 Google Cloud VM with custom DNS/mail infrastructure

Initial Access

1 technique
T1190Exploit Public-Facing ApplicationEvidence1

The arrival vector likely involves the exploitation of a public-facing website or abuse of compromised remote desktop protocol (RDP) credentials.

Impact

1 technique
T1486Data Encrypted for ImpactEvidence3

In a recent intrusion, we identified a ransomware deployment that appended the file extension .ViceSociety to all encrypted files...

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
20 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app3 months ago
ip.v4●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app4 months ago
domain●●●●●●●●●●●●View more in app4 months ago
domain●●●●●●●●●●●●View more in app4 months ago
domain●●●●●●●●●●●●View more in app4 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.