Zeon

MITRE ATT&CK does not currently catalogue Zeon, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: zeon uses PowerShell scripts to execute malicious commands and deploy payloads across compromised systems.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1106 Native API Execution

   What they do: zeon leverages native API calls to interact with system functions for execution and evasion.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

3. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: zeon establishes persistence by modifying registry run keys to ensure recurring execution.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

4. T1685 Disable or Modify Tools Defense Impairment

   What they do: zeon disables security tools like antivirus software and monitoring agents to hinder incident response.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

5. T1070.004 File Deletion Stealth

   What they do: zeon deletes critical files such as Volume Shadow Copies and backup directories to prevent recovery.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

6. T1003.001 LSASS Memory Credential Access

   What they do: zeon accesses LSASS memory to steal credentials for lateral movement and privilege escalation.

   What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

7. T1049 System Network Connections Discovery Discovery

   What they do: zeon discovers system network connections to identify targets and exfiltrate data silently.

   What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

8. T1021.002 SMB/Windows Admin Shares Lateral Movement

   What they do: zeon moves laterally via SMB shares to access additional systems within the victim network.

   What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

9. T1486 Data Encrypted for Impact Impact

   What they do: zeon encrypts victim files using strong symmetric encryption to maximize impact and extortion.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

10. T1490 Inhibit System Recovery Impact

    What they do: zeon invokes system recovery mechanisms like shutdown scripts to disable restoration attempts.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

All of your files are currently encrypted by ZEON strain.

All of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.

To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.

You can contact our team directly for further instructions through our website :

TOR VERSION :
(you should download and install TOR browser first https://torproject.org)

http://zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion/

YOU SHOULD BE AWARE
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond.
So it will be better for both sides if you contact us as soon as possible.


---BEGIN ID---
[snip]
----END ID----

Ransom-note text from RansomLook, licensed CC BY 4.0.