Loading threat actor…
Haron is a ransomware threat group and malware family that emerged in mid-2021 as a Thanos-derived operation. It is widely assessed as part of the broader cluster of ransomware variants built from leaked Thanos code, and has also been reported as showing overlap with Avaddon. Some researchers have suspected an operational relationship or rebrand from Prometheus, another Thanos-based ransomware group, but that linkage is not conclusively established. Haron is associated with enterprise-focused ransomware intrusions against organizations considered capable of paying high-value ransoms. The group used double extortion, combining file encryption with theft of victim data and threats to publish stolen information through its own leak site. Its ransom messaging threatened staged disclosure of exfiltrated data if victims did not engage. Technically, Haron is a .NET ransomware strain that has been observed using SmartAssembly obfuscation and implementation patterns strongly associated with Thanos, including encoded and reversed strings, shared ransom-note conventions, and common file markers seen across related variants such as Prometheus, Spook, and Midas. Haron drops standard ransom notes and appends victim- or company-themed extensions to encrypted files. Observed behavior includes broad file targeting across documents, archives, databases, images, virtual disks, and backup-related data; enumeration of local drives and network-accessible resources; termination of processes and services associated with security tools, backup platforms, databases, mail servers, and office applications; and recovery inhibition through deletion of shadow copies, backup destruction, and related system commands. Haron has also been observed modifying firewall settings and enabling network discovery and file-sharing-related functionality to facilitate operations across network shares. Known aliases and related naming include the Chaddad variant, reflecting one observed extension and branding overlap within the Thanos-derived ecosystem. Haron is best understood as a financially motivated ransomware actor operating within the post-leak Thanos lineage and using mature double-extortion tradecraft against larger organizational victims.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Thanos-derived ransomware variant with its own leak site for double extortion; the article suggests a possible operational link between Haron and Midas because Midas leaked data from a Haron attack.
A ransomware operation/case study focused on reverse engineering a .NET Haron sample. The sample appears based on or heavily inspired by Thanos and includes double-extortion behavior, ransom notes, Tor payment portal instructions, process/service termination, shadow copy deletion, network share enumeration, and file encryption.
Mentioned as a newly emerged ransomware threat group targeting large organizations for high-value ransom payments.
A ransomware group that emerged after Prometheus went quiet and is suspected by some experts to be a rebrand of Prometheus, also using the Thanos codebase.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.