Tuesday, December 5, 2023

Hackers Using Remote Desktop Application To Install “Zeppelin” Ransomware & Encrypt Windows Files

Cybercriminals abusing a Remote Desktop application ConnectWise Control that previously known as (ScreenConnect) to deliver the Zeppelin Ransowmare (aka Vega) and encrypt the victim’s files in Windows PC.

ConnectWise is a remote desktop software mostly used in the enterprise network and MSPs to connect the systems remotely for support. You’ll also find session recording and screen sharing with this remote access program. 

ConnectWise Control already abused by hackers to breach the largest IT service provider Wipro network and gained access to Wipro systems.

GBHackers recently reported that the Zeppelin ransomware campaign targets IT and healthcare companies in Europe and the U.S.

The newly observed campaign now expand its operation and targeting the real estate industries, and it employed the additional info-stealers, and Cobalt beacons to deliver the ransomware payload.

Researchers observed that the attackers try to exfiltrate the information from the Windows database server by stealing the backup information and propagate the ransomware across the network.

Zeppelin Ransomware Module

Initially, Zeppelin ransomware deliver via ScreenConnect remote desktop control application.

Once ScreenConnect CMD shell gets executed, ScreenConnect service creates and executes a temporarily hidden run.cmd file that contains the remotely executed commands.

Later the attackers execute the PowerShell command to download the next stage of the command from the C2 server hxxp://45.142.213[.]167/oxf where it again connect the C2 server to downloads the Zeppelin ransomware artifact. 


According to Morphisec report, As part of different campaigns, we observed the adversary using two versions for each ransomware or stealer variant. In this specific campaign, we identified the same ransomware delivered in packed (with a custom packer framework) and unpacked ways.

The ransomware also using the delivery method such as vidar info stealer, cobalt strike beacons, PS2EXE tools, banker trojans from the same IP and one more IP hosted through colocation services.

Attackers also having a list of commands to stop the database process to prevent the victims the replace the backup with the infected data.

You can read here the complete infection process of Zeppelin ransomware.

Indicators of Compromise

CFCBD89AC2A32EF179CB39ABB569A952P1.exe (Info stealer)
FEE6BA9A0D7A805B3281D4F955821C1COxfordnew.exe (Zeppelin)
A8E670C63E257049A7BCAE632C9ACEF6Oxford.exe (Zeppelin)
3F120DE1249E8724EC1C1EF255F26067Rdp.exe (PS2EXE)
0D442C4D8B4C4312840675CAC8D69661Vid.exe (Vidar)

Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles