Zeon is a criminal group formed by former Conti members turned Royal, known for targeted ransomware attacks with private toolsets.
Zeon is a crime group formed by former Conti 'Team One' members, active before rebranding as Royal in September 2022. The group deliberately avoids the Ransomware-as-a-Service model, keeping its code and infrastructure private. Key TTPs include targeted ransomware attacks, a custom toolset, and data exfiltration. Defenders should monitor for indicators linked to Royal ransomware encryption and restrict access to external services.
Zeon was the precursor identity used by the group that rebranded as Royal in September 2022, composed primarily of former Conti "Team One" members, deliberately avoiding the RaaS model and keeping its code and infrastructure private.
The Zeon group was formed by former Conti 'Team One' members.
The Zeon group deliberately avoids the RaaS model, keeping its code and infrastructure private.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.