Zeon

Zeon, a known threat actor in the cybersecurity landscape, has been linked to several high-profile ransomware attacks. It was instrumental in crypting SVCReady and CargoBay loaders, observed in Quantum and Royal ransomware attacks respectively. Zeon has also employed third-party ransomware such as BlackCat and custom Zeon ransomware in its operations. Over time, this malware has been associated with various attacks including Quantum, Royal, Zeon, and BlackBasta. Approximately a year ago, ITG23, another threat group, stopped using its successful Conti ransomware strain, leading to its members creating or joining new operations like Quantum, Royal, Zeon, and BlackBasta. In the aftermath of the ITG23 dissolution, these factions continued to use many of the same crypters, indicating an ongoing cooperation among former members. The use of Rust programming language has also increased, with developers releasing Rust versions of malware including BlackCat, Hive, Zeon, and RansomExx. Recently, Zeon has been identified as operating as a group of elite pentesters primarily for Akira and LockBit, two prominent ransomware groups. The takedown of LockBit had a significant impact on Zeon, forcing it to shift its focus to the Akira brand. The recent troubles faced by LockBit and Akira have created a relative vacuum in the ransomware landscape, which, according to cybersecurity firm RedSense, has been partly filled by the Akira ransomware collective and associated "ghost groups" like Zeon. Keeping software fully patched and updated is considered a top defense against Zeon hackers. However, pentesters associated with Zeon are likely to continue tricking victims into installing remote management and monitoring software, targeting ESXi and cloud environments. These developments suggest that Zeon's increased involvement with Akira could lead to more sophisticated and damaging cyber threats in the future.