Millions of dollars in cryptocurrency has been confiscated as the DoJ cracks down on an infamous ransomware operator

Millions of dollars worth of cryptocurrency has been seized by the DoJ
The wallet belongs to a suspected ransomware operator
The ransomware, Zeppelin, is functionally extinct

The US Department of Justice (DoJ) has announced a cryptocurrency wallet containing over $2.8 million has been seized following charges of conspiring to commit computer fraud and abuse, computer fraud and abuse, and conspiracy to commit money laundering brought against the wallet’s owner.

Ianis Aleksandrovich Antropenko is thought to have headed up the now defunct Zeppelin ransomware operation, which collapsed in 2022, to ‘ target and attack a wide range of individuals, businesses, and organizations worldwide, including in the United States,’ the statement confirmed.

Zeppelin was a ransomware-as-a-service tool which uses phishing as a point of contact, using double extortion methods to steal and encrypt data to then sell (or threaten to sell) on the dark web.

Luxury assets

Alongside the cryptocurrency, the DoJ also seized $70,000 in cash as well as a luxury vehicle, assets which are alleged to be involved in ransomware activity – mostly having been used to launder proceeds gained through ransom payments.

‘Those assets were laundered in various ways, including by using the cryptocurrency mixing service ChipMixer, which was taken down in a coordinated international operation in 2023. Antropenko also laundered cryptocurrency by exchanging cryptocurrency for cash and depositing the cash in structured cash deposits.’

Zeppelin has been used to victimize organisations in manufacturing, IT, healthcare, and finance industries – particularly those that rely on sensitive data.

The RaaS was introduced in 2019, and tactics evolved over the next few years, with actors using the tool to distribute malware. However, after sloppy updated versions were released in 2021, the tool became significantly less prominent.

By 2022, the service was essentially abandoned. Security researchers Unit221b developed a decryptor key after the tool was used to attack nonprofits, homeless shelters, and charity organisations.