Researchers Quietly Cracked Zeppelin Ransomware Keys
Summary: Unit 221B founder Lance James found vulnerabilities in Zeppelin ransomware's encryption routines that let him brute-force decryption keys in hours using nearly 100 cloud servers, and the firm quietly helped nearly two dozen victim organizations recover without paying. The break came from recovering an ephemeral RSA-512 public key, which Zeppelin deletes once files are encrypted, giving roughly a five-minute window for memory analysis; Unit 221B built a Linux Live CD to extract the key and used 800 CPUs donated by Digital Ocean to crack it.
What's compelling: The FBI and CISA warned in August 2022 that Zeppelin actors hit defense contractors, manufacturers, and especially healthcare organizations, with ransom demands from several thousand dollars to over a million, and that actors spend one to two weeks mapping victim networks including cloud storage and backups before deploying. Unit 221B kept its capability quiet specifically because announcing a decryptor prompts ransomware groups to change their code.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·