Zeon
Zeon is a ransomware encryptor associated with the post-Conti cybercrime ecosystem and closely linked to the early development of the Royal ransomware operation.
Profile source: Mallory opens in a new tabZeon
Family profile
Zeon is a ransomware encryptor associated with the post-Conti cybercrime ecosystem and closely linked to the early development of the Royal ransomware operation. It emerged in 2022 and is described as one of the in-house encryptors used by actors who later operated under the Royal and subsequently BlackSuit branding. Zeon-generated ransom notes were noted for strong similarities to Conti-style notes, reinforcing its lineage within the broader Russian-speaking ransomware landscape.
Available reporting indicates Zeon was used against enterprise environments and Windows networks in human-operated intrusions. In these operations, actors typically obtained access through social-engineering-driven phishing, including callback phishing, and in some cases through exploitation of vulnerable internet-facing applications. After access, operators conducted credential harvesting, lateral movement across Windows domains, data theft, and file encryption as part of double-extortion activity. U.S. government reporting further states that Royal evolved from earlier iterations that used Zeon as a loader, indicating Zeon also played a role in the transition toward Royal’s later custom tooling.
Zeon has also been referenced among ransomware families that adopted Rust-based implementations, reflecting a broader trend among ransomware developers toward Rust for cross-platform development and more analysis-resistant binaries. However, the strongest high-confidence characterization supported here is Zeon’s role as a ransomware family tied to Conti successor actors and the early Royal lineage.
Capabilities
- Credential Theft
- Exfiltration
- Lateral Movement
Operational record
Reporting
Research mentioning Zeon
Шифровальщики-вымогатели The Digest "Crypto-Ransomware": RansomEXX
Researchers identified a Linux-targeting variant of RansomEXX, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with AES-256 in ECB mode and appends an RSA-4096-encrypted AES key to each file, using cryptographic functions from the mbedtls library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
