The report examines the Zedxion, Zedcex, ZedPay, and BZ Group network as a layered financial architecture spanning the United Kingdom and the United Arab Emirates, with durable domains, token infrastructure, and corporate shells that persist while legal entities are cycled. It also highlights sanctions-evasion concerns tied to Babak Morteza Zanjani, Elizabeth Newman, OFAC designations, and alleged links to the IRGC. #Zedxion #Zedcex #ZedPay #BZGroup #BabakMortezaZanjani #ElizabethNewman #OFAC #IRGC
Keypoints
- The network centers on ZEDXION EXCHANGE LTD, ZEDCEX EXCHANGE LTD, ZedPay, and the broader BZ Group ecosystem.
- UK companies are described as disposable shells with high nominal capital, dormant filings, and frequent restructuring or dissolution.
- Digital infrastructure such as domains, email hosts, and the ZEDXION token persists across corporate changes, indicating operational continuity.
- Elizabeth Newman is identified as the post-2022 operational controller, while Babak Morteza Zanjani is framed as the upstream strategic origin.
- The report says branding such as “bank,” “IBAN,” and exchange terminology creates implied legitimacy without matching licensing.
- U.S. litigation and OFAC designations are cited, including allegations of laundering fraud proceeds and sanctions-evasion activity benefiting the IRGC.
- The UAE is presented as the durable operational base, while the UK functions as a flexible incorporation and regulatory interface venue.
MITRE Techniques
- [T1583.001 ] Acquire Infrastructure: Domains – The network maintains persistent branded domains and mail hosts to support continuity across shell-company changes (‘domains, mail hosts, and token assets persist across corporate restructuring events’).
- [T1587.001 ] Develop Capabilities: Malware? – Not mentioned.
- [T1584.001 ] Compromise Infrastructure: DNS Hijacking – Not mentioned.
- [T1588.002 ] Obtain Capabilities: Tool – The article describes obtaining and reusing financial/digital infrastructure rather than malware tools (‘core domains, mail hosts, and token assets persist’).
- [T1090 ] Proxy – The architecture layers exchange, payments, and corporate shells to route and obscure transactions (‘separation of exchange, token, and payments branding reduces concentration risk’).
- [T1036 ] Masquerading – Bank-like and exchange-like naming is used to imply legitimate status (‘adopt institutional terminology without corresponding licensing’).
- [T1589.001 ] Gather Victim Identity Information: Credentials? – Not mentioned.
- [T1102 ] Web Service – The ecosystem relies on web domains and online branding to present services (‘domains such as zedxion[.]com, zedcex[.]com’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – Not mentioned.
- [T1648 ] Serverless Execution? – Not mentioned.
Indicators of Compromise
- [Domains ] Exchange, payments, banking-façade, and trade infrastructure – zedxion[.]com, zedcex[.]com, zed-pay[.]com, and mail-zedxion[.]com
- [Domains ] Banking-style and legacy brand domains – bz-bank[.]com, kontbank[.]com, and sctbankers[.]com
- [Domains ] Commodity/trade cover domains – bz-diamond[.]com, bzdiamond[.]ae, and metal-istanbul[.]com
- [Email addresses ] Operational and developer email artifacts linked to control – developer@zedxion[.]com, mail-zedxion[.]com, and mail-zedcex[.]com
- [Organizations ] Corporate entities referenced in the network – ZEDXION EXCHANGE LTD, ZEDCEX EXCHANGE LTD, ZedPay, BZ BROKER LIMITED, and BZ DIAMOND LTD
- [Cryptocurrency/token names ] Token layer used for capital-formation signaling – ZEDXION token (ERC-20, BEP-20)
- [File names / court records ] Litigation and corporate records cited as evidence – gov.uscourts.txed.236381.3.3.pdf, 13404089_psc01_2022-08-19.pdf, and 08547173_ap01_2017-12-08.pdf
- [Monetary figure ] Alleged fraud-proceeds routing – approximately $348,907.18
Read more: https://dti.domaintools.com/research/the-zedxion-corporate-nexus