ZEPPELIN
Zeppelin is a ransomware family active in attacks observed between at least 2019 and 2022. Reporting in the provided content links it to a ransomware operation led by a Russian national who pleaded guilty in the U.S. to leading the Zeppelin ransomware group and admitted targeting individuals, businesses, and organizations in the United States and other parts of the world. Zeppelin has also been used as a third-party locker by the Vice Society/Vanilla Tempest threat actor, which deployed Zeppelin alongside other ransomware families such as Hello Kitty/Five Hands, BlackCat, Quantum Locker, and later Rhysida/INC depending on period.
In the supplied reporting, Vice Society actors are explicitly described as not relying on a unique ransomware family and instead deploying variants including Zeppelin. Their intrusions involved initial access via exploitation of internet-facing applications or compromised valid accounts/RDP credentials, followed by lateral movement and staging with tools such as Cobalt Strike, SystemBC, PowerShell Empire, WMI, Rubeus, Mimikatz, and PowerShell. In one Trend Micro-observed intrusion, Zeppelin ransomware was deployed on 2022-11-12 from C:\mnt\smile.exe before Vice Society also deployed its own payloads. The broader attack workflow described for these actors included data exfiltration prior to encryption for double extortion, deletion of shadow copies, termination of security and business-critical processes, and impact to sectors including education, healthcare, manufacturing, and virtualized environments such as Microsoft Hyper-V.
The content also notes infrastructure overlap/intelligence associations involving Zeppelin: OTX associated IP 34.41.139.193 with Zeppelin ransomware along with NetWire RAT, ClearFake, AsyncRAT, XWorm, Formbook, and StealC-related activity. Mandiant additionally noted reported overlaps between COLDDRAW and Zeppelin, including reporting that Zeppelin had been distributed via CHANITOR. A technical behavior specifically mentioned for Zeppelin is that it queries the Windows MachineGUID. High-confidence indicators directly mentioned in the content include the observed deployment path C:\mnt\smile.exe and the infrastructure association with 34.41.139.193.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Vice Society actors have been observed exploiting the PrintNightmare vulnerability (CVE-2021-1675 and CVE-2021-34527) to escalate privileges.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While active as Vice Society, the threat actor was known for using multiple ransomware strains during attacks, including Hello Kitty/Five Hands and Zeppelin ransomware.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniquesMITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: Domains T1583.001 joscramp[.]top + 7 co-hosted domains via Dynadot
MITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: Server T1583.004 Google Cloud VM with custom DNS/mail infrastructure
Initial Access
1 techniqueThe arrival vector likely involves the exploitation of a public-facing website or abuse of compromised remote desktop protocol (RDP) credentials.
Impact
1 techniqueData Encrypted for Impact T1486 ... Vice Society actors have encrypted data on target systems or on large numbers of systems in a network to interrupt availability.
IOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A third-party ransomware locker delivered in Vice Society attacks.
Zeppelin is identified as ransomware associated with the same shared IP infrastructure in February 2026.
Ransomware used by the Zeppelin group in a multi-year campaign targeting dozens of victims (at least 50 mentioned).
Ransomware used to compromise victims and extort payments; referenced in the context of law-enforcement action against its leadership.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.