Hackers have been using Zeppelin Ransomware to launch cyberattacks against businesses and critical infrastructure since at least 2019, according to a CISA and FBI warning issued today. The warning also included some timely mitigation guidance that MSPs and MSSPs can use to protect their own systems and end-customer networks.Zeppelin ransomware is a relative of the Delphi-based Vega malware family, and leverages a Ransomware as a Service (RaaS) model, the warning noted. Attack targets -- extending from 2019 through June 2022 -- have included defense contractors, educational institutions, manufacturers, technology companies, and especially organizations in the healthcare and medical industries, the warning noted.The Zeppelin threat actors gain access to victim networks via RDP exploitation , exploiting SonicWall firewall vulnerabilities , and phishing campaigns , the CISA and FBI revealed. Ransomware demands -- to be paid in Bitcoin -- often range from several thousand dollars to over $1 million, the government agencies said.Boundary logs showing communication to and from foreign IP addresses; a sample ransom note; communications with Zeppelin actors; Bitcoin wallet information; decryptor files; and/or a benign sample of an encrypted file. As per previous guidance, the FBI and CISA do not encourage paying ransom -- since payment does not guarantee victim files will be recovered. Also, the FBI and CISA urge victims to promptly report ransomware incidents to a local FBI Field Office, CISA at us-cert.cisa.gov/report, or the U.S. Secret Service (USSS) at a USSS Field Office.