Millions of dollars in cryptocurrency has been confiscated as the DoJ cracks down on an infamous ransomware operator

News
By published

Over $2.8 million seized from alleged Zeppelin owner

  • Millions of dollars worth of cryptocurrency has been seized by the DoJ
  • The wallet belongs to a suspected ransomware operator
  • The ransomware, Zeppelin, is functionally extinct

The US Department of Justice (DoJ) has announced a cryptocurrency wallet containing over $2.8 million has been seized following charges of conspiring to commit computer fraud and abuse, computer fraud and abuse, and conspiracy to commit money laundering brought against the wallet's owner.

Ianis Aleksandrovich Antropenko is thought to have headed up the now defunct Zeppelin ransomware operation, which collapsed in 2022, to ‘ target and attack a wide range of individuals, businesses, and organizations worldwide, including in the United States,’ the statement confirmed.

Zeppelin was a ransomware-as-a-service tool which uses phishing as a point of contact, using double extortion methods to steal and encrypt data to then sell (or threaten to sell) on the dark web.

Luxury assets

Alongside the cryptocurrency, the DoJ also seized $70,000 in cash as well as a luxury vehicle, assets which are alleged to be involved in ransomware activity - mostly having been used to launder proceeds gained through ransom payments.

‘Those assets were laundered in various ways, including by using the cryptocurrency mixing service ChipMixer, which was taken down in a coordinated international operation in 2023. Antropenko also laundered cryptocurrency by exchanging cryptocurrency for cash and depositing the cash in structured cash deposits.’

Zeppelin has been used to victimize organisations in manufacturing, IT, healthcare, and finance industries - particularly those that rely on sensitive data.

The RaaS was introduced in 2019, and tactics evolved over the next few years, with actors using the tool to distribute malware. However, after sloppy updated versions were released in 2021, the tool became significantly less prominent.

By 2022, the service was essentially abandoned. Security researchers Unit221b developed a decryptor key after the tool was used to attack nonprofits, homeless shelters, and charity organisations.

You might also like

Ellen Jennings-Trace
Ellen Jennings-Trace
Staff Writer

Ellen has been writing for almost four years, with a focus on post-COVID policy whilst studying for BA Politics and International Relations at the University of Cardiff, followed by an MA in Political Communication. Before joining TechRadar Pro as a Junior Writer, she worked for Future Publishing’s MVC content team, working with merchants and retailers to upload content.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.