zeon

Executive Summary

Zeon is a medium-sophistication criminal threat actor group, formerly known as Royal, composed of former members of Conti's 'Team One.' They avoid the ransomware-as-a-service (RaaS) model, maintaining private code and infrastructure. Targeting sectors and countries remain unspecified, but their primary goal is financial gain through ransomware activities.

Goals & Targeting

Zeon operates with financial gain as its primary motivation, leveraging ransomware to extort victims. Their targets are not explicitly defined but typically include sectors like healthcare, education, and critical infrastructure where ransoms can be substantial and less likely to be reported. The group's focus on organizational gain suggests a strategic approach to maximize profits while minimizing operational risks.

Zeon emerged as a rebranded group from Royal in September 2022. Originally part of Conti's 'Team One,' Zeon chose independence over RaaS models, keeping its tools and infrastructure private. This suggests a more self-reliant approach compared to affiliate groups within RaaS ecosystems. The group primarily deploys ransomware for financial gain, targeting unspecified sectors but likely focusing on industries vulnerable to such attacks. Their operational strategy includes phishing campaigns with malicious email attachments or links, exploiting known vulnerabilities to infiltrate target networks. Zeon's decision to avoid the RaaS model indicates strategic independence, possibly reducing risks associated with affiliate relationships while maintaining control over their operations.

Key Capabilities

• Ransomware deployment
• Phishing campaigns
• Malware development
• Network infiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Zeon's campaign patterns involve targeted phishing with malicious emails, often using legitimate-looking domains for command-and-control (C2) communication. Their operational tempo suggests persistence in identifying high-value targets across multiple industries. Notable past operations include several small-scale ransomware attacks targeting regional businesses and educational institutions.

IOC Patterns

• Phishing emails with malicious attachments or links
• Scheduled task-based persistence (T1053)
• Encrypted files on compromised systems

Recommended Actions

• Implement multi-layered email filtering to detect phishing attempts
• Conduct regular patch management to address known vulnerabilities
• Monitor network traffic for indicators of Zeon's TTPs, such as C2 communication via legitimate-looking domains

Suggested Tags