Zeon is a ransomware group that first emerged in late January 2022 as a low-sophistication, commodity-level threat. Its primary motivation was financial extortion, targeting businesses to demand cryptocurrency payments. The group distinguished itself by utilizing custom, Python-based ransomware executables, often obfuscated with pyArmor, and by implementing double extortion tactics, threatening to publish exfiltrated data if ransom demands were not met. Zeon operated under this name until September 2022, when it rebranded as Royal ransomware, integrating actors previously associated with Conti and TrickBot malware, and maintaining a private coding and infrastructure model rather than a Ransomware-as-a-Service (RaaS) operation.

URLs nuevas detectadas en IntelTracker