Description
Zeppelin is a ransomware variant based on an established code base that has targeted healthcare and other sectors through double extortion. Its operators exfiltrate data before encryption and pressure organizations through negotiators, and United States government agencies issued an advisory detailing its tactics after campaigns against the healthcare sector. Detections under this name warrant immediate containment because encryption spreads through network shares once the payload executes.
Stats
- First seen
- April 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Binary.Ransomware.Zeppelin |
| Gen:Variant.Ransom.Zeppelin.20 |
| Gen:Variant.Ransom.Zeppelin.29 |
| Gen:Variant.Ransom.Zeppelin.38 |
| Trojan.Ransom.Zeppelin.I |
| Win32.Ransomware.Zeppelin |