Loading malware…
Charon is a ransomware family first documented in targeted attacks against public sector organizations and aviation entities in the Middle East. Reporting describes it as a novel ransomware strain that uses APT-style tradecraft, including DLL sideloading, multistage shellcode delivery, process injection, and process hollowing. In the observed intrusion chain, a legitimate binary renamed to Edge.exe (originally cookie_exporter.exe) sideloads a malicious msedge.dll loader identified as SWORDLDR. That DLL reads and decodes DumpStack.log, performs anti-debug checks, and injects staged shellcode into a suspended svchost.exe process, ultimately loading the Charon ransomware payload entirely in memory.
Charon is reported to overlap technically with activity associated with Earth Baxia, also tracked as APT41, Wicked Panda, and Grass Typhoon, but the available reporting does not definitively attribute the ransomware operation to that group. The campaign was described as highly targeted, including customized ransom notes naming victim organizations.
Once executed, Charon performs anti-recovery and disruptive actions, including deleting shadow copies via COM and VSS interfaces, stopping backup-, database-, and security-related services, and terminating processes associated with enterprise applications and Microsoft Office. It enumerates network shares using NetShareEnum and WNetEnumResource, skips ADMIN$ shares, and uses multiple worker threads to parallelize encryption. Charon encrypts files using a hybrid scheme with Curve25519 (X25519) for key agreement and ChaCha20 for file encryption, appends the .Charon extension to encrypted files, and adds a 72-byte footer containing victim public key and encryption metadata. It drops a ransom note named How To Restore Your Files.txt to drives, network shares, and folders, and creates the mutex OopsCharonHere for single-instance execution.
Observed indicators and artifacts directly mentioned in reporting include the files Edge.exe, msedge.dll, DumpStack.log, Charon_Ransomware.exe, the ransom note How To Restore Your Files.txt, the .Charon file extension, and the mutex OopsCharonHere. Reported SHA-256 hashes are: Edge.exe 5d0675f20eeb8f824097791711135a273680f77bf5e9f0e168074e97464f21b5; msedge.dll e0a23c0d99c45d40f6ef99c901bacf04bb12e9a3a15823b663b392abadd2444e; DumpStack.log 739e2cac9e2a15631c770236b34ba569aad1d1de87c6243f285bf1995af2cdc2; Charon_Ransomware.exe 80711e37f226ef1dc86dc80a8cbc0b2ec895b361e9ade85da793d94b1d876be8; ransom note 8e6b1aa03a28590eac9b5ef0e58f37849169ca47c8990e7d34525000e5759402. Reporting also notes dormant code to deploy %SystemRoot%\System32\Drivers\WWC.sys as a service named WWC, described as derived from dark-kill for EDR bypass, though that capability was not executed in the analyzed sample.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A new ransomware dubbed Charon has been observed in targeted attacks against public sector and Middle Eastern aviation.
Charon is a new ransomware family ... Trend Micro observed it being deployed in a targeted attack in the Middle East's public sector and aviation industry — the first such record of Charon observed in the wild.
Charon is a new ransomware family ... Trend Micro observed it being deployed in a targeted attack in the Middle East's public sector and aviation industry — the first such record of Charon observed in the wild.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
At start, the shellcode resolves ntdll!LdrLoadDll, NtAllocateVirtualMemory, NtProtectVirtualMemory, and NtFreeVirtualMemory... Selected API hashes resolved by stage‑2 for injection/execution: NtGetContextThread, NtOpenThread, NtSetContextThread, NtResumeThread.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... "The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload."
That DLL is then responsible for decrypting the embedded ransomware payload and injecting it into a newly spawned svchost.exe process. "This technique allows the malware to masquerade as a legitimate Windows service, bypassing usual endpoint security controls," the researchers observed.
CreateProcess(... CREATE_SUSPENDED) + VirtualAllocEx / WriteProcessMemory / SetThreadContext / ResumeThread T1055.012 - Process Injection: Process Hollowing Inject/hollow into svchost.exe and transfer control to staged shellcode/PE.
В мае 2026-го Qualys Threat Research Unit раскрыла CVE-2026-46333 ... Четыре рабочих эксплойта ... Непривилегированный локальный пользователь мог читать /etc/shadow, красть SSH host private keys или получить root-шелл ... Между тобой и полным контролем - барьер привилегий ядра.
Charon also uses a multistage payload extraction technique via what appears to be a benign log file, DumpStack.log. Upon closer inspection however, this turns out to be an encrypted shellcode responsible for delivering the ransomware payload... Further analysis also revealed a second layer of encryption within the intermediate payload.
This technique allows the malware to masquerade as a legitimate Windows service, bypassing usual endpoint security controls.
That DLL is then responsible for decrypting the embedded ransomware payload and injecting it into a newly spawned svchost.exe process. "This technique allows the malware to masquerade as a legitimate Windows service, bypassing usual endpoint security controls," the researchers observed.
CreateProcess(... CREATE_SUSPENDED) + VirtualAllocEx / WriteProcessMemory / SetThreadContext / ResumeThread T1055.012 - Process Injection: Process Hollowing Inject/hollow into svchost.exe and transfer control to staged shellcode/PE.
Shell32!SHEmptyRecycleBinW T1070.004 - Indicator Removal: File Deletion Empty Recycle Bin.
It checks for the presence of DumpStack.log, reads and decodes the file into payload_shellcode_layer_1... Stage‑2 begins by XOR‑decoding and calling RtlDecompressBuffer to produce the Charon PE in memory.
Kernel32!CreateMutexW (mutex: OopsCharonHere ) T1480.002 - Execution Guardrails: Mutual Exclusion Single instance control.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... "The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload."
chage -- /etc/shadow ... атакующий через pidfd_getfd() перехватывает FD и читает содержимое - хеши паролей всех локальных пользователей.
Утечка credentials: /etc/shadow и SSH host keys ... атакующий через pidfd_getfd() перехватывает FD и читает содержимое - хеши паролей всех локальных пользователей ... /usr/lib/openssh/ssh-keysign ... атакующий перехватывает дескриптор - и вот у него приватные ключи хоста.
CNG/CryptoAPI (e.g., BCryptGenRandom ; custom X25519+ChaCha20 implementation) T1486 - Data Encrypted for Impact Generate 32‑byte private key → ECDH with attacker pubkey → derive 256‑bit key → modified ChaCha20 → partial encryption + 72‑byte footer.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... Further defense tactics that organizations can adopt to combat advanced ransomware tactics include ensuring that EDR and antivirus agents are running with capabilities that prevent malware from disabling, tampering with, or uninstalling the security solutions.
Advapi32!OpenSCManagerW / OpenServiceW / ControlServiceW T1489 - Service Stop & T1562.001 - Impair Defenses: Disable or Modify Tools... Kernel32!OpenProcess / TerminateProcess T1562.001 - Impair Defenses: Disable or Modify Tools Terminate AV/EDR‑related processes.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware targeting Middle East public sector and aviation; uses APT-like evasion (DLL sideloading, process injection) (per summary).
Sophisticated ransomware delivered through a multi-stage loader chain. It uses DLL sideloading, shellcode staging, process hollowing into svchost.exe, anti-debugging, anti-recovery and defense-impairment actions, enumerates local and network shares, encrypts files in memory using a hybrid Curve25519/X25519 plus ChaCha20 scheme, appends a 72-byte footer, renames files with the .Charon extension, and drops a ransom note.
CHARON is a ransomware family that uses advanced evasion techniques such as DLL sideloading and process injection. It targets public sector and aviation organizations in the Middle East, disables security services, deletes backups, and customizes ransom notes for each victim. It shows technical overlap with the China-linked Earth Baxia group.
Ransomware using advanced persistent threat (APT) techniques to target enterprises in the Middle East.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.