Loading malware…
Charon is a ransomware family first documented in targeted intrusions against public sector organizations and aviation entities in the Middle East. It has been noted for combining ransomware objectives with tradecraft more commonly associated with advanced persistent threat operations, including DLL sideloading, multistage shellcode delivery, in-memory payload execution, and process hollowing. Reporting has identified technical overlaps with activity associated with Earth Baxia, also tracked as APT41, Wicked Panda, and Grass Typhoon, but definitive attribution remains unconfirmed.
Observed Charon attack chains use a legitimate executable to sideload a malicious DLL loader known as SWORDLDR. That loader decodes an intermediate encrypted blob, performs anti-debug checks, spawns a suspended Windows service host process, and injects staged shellcode into it. The shellcode reconstructs and launches the ransomware payload entirely in memory, reducing on-disk exposure and complicating detection. The malware also includes single-instance controls and supports command-line options for targeting paths and network shares.
Once active, Charon enumerates local and network-accessible data, including shared resources, and encrypts files using a hybrid scheme based on Curve25519 key agreement and ChaCha20 file encryption. It uses partial-encryption logic to balance speed and impact, appends a dedicated extension to encrypted files, and writes ransom notes across affected locations. To maximize disruption and hinder restoration, Charon attempts to delete shadow copies and targets backup, database, and security-related services and processes for termination or stoppage before or during encryption.
The malware demonstrates strong defense-evasion characteristics. In addition to DLL sideloading and process hollowing, the payload bundle has contained dormant code for deployment of a kernel driver derived from dark-kill intended to disable endpoint security products, although that capability was not executed in the analyzed sample. Charon exemplifies the convergence of ransomware operations with APT-style intrusion methods, increasing operational and recovery risk for targeted enterprises and government-linked organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earlier this year several watering hole attacks targeting South Korea utilized an ActiveX 0day exploit in M2Soft to deliver Lazarus-connected FBI-RAT and Charon implants.
A new ransomware dubbed Charon has been observed in targeted attacks against public sector and Middle Eastern aviation.
Charon is a new ransomware family ... Trend Micro observed it being deployed in a targeted attack in the Middle East's public sector and aviation industry — the first such record of Charon observed in the wild.
Charon is a new ransomware family ... Trend Micro observed it being deployed in a targeted attack in the Middle East's public sector and aviation industry — the first such record of Charon observed in the wild.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
At start, the shellcode resolves ntdll!LdrLoadDll, NtAllocateVirtualMemory, NtProtectVirtualMemory, and NtFreeVirtualMemory... Selected API hashes resolved by stage‑2 for injection/execution: NtGetContextThread, NtOpenThread, NtSetContextThread, NtResumeThread.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... "The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload."
That DLL is then responsible for decrypting the embedded ransomware payload and injecting it into a newly spawned svchost.exe process. "This technique allows the malware to masquerade as a legitimate Windows service, bypassing usual endpoint security controls," the researchers observed.
CreateProcess(... CREATE_SUSPENDED) + VirtualAllocEx / WriteProcessMemory / SetThreadContext / ResumeThread T1055.012 - Process Injection: Process Hollowing Inject/hollow into svchost.exe and transfer control to staged shellcode/PE.
В мае 2026-го Qualys Threat Research Unit раскрыла CVE-2026-46333 ... Четыре рабочих эксплойта ... Непривилегированный локальный пользователь мог читать /etc/shadow, красть SSH host private keys или получить root-шелл ... Между тобой и полным контролем - барьер привилегий ядра.
Charon also uses a multistage payload extraction technique via what appears to be a benign log file, DumpStack.log. Upon closer inspection however, this turns out to be an encrypted shellcode responsible for delivering the ransomware payload... Further analysis also revealed a second layer of encryption within the intermediate payload.
This technique allows the malware to masquerade as a legitimate Windows service, bypassing usual endpoint security controls.
That DLL is then responsible for decrypting the embedded ransomware payload and injecting it into a newly spawned svchost.exe process. "This technique allows the malware to masquerade as a legitimate Windows service, bypassing usual endpoint security controls," the researchers observed.
CreateProcess(... CREATE_SUSPENDED) + VirtualAllocEx / WriteProcessMemory / SetThreadContext / ResumeThread T1055.012 - Process Injection: Process Hollowing Inject/hollow into svchost.exe and transfer control to staged shellcode/PE.
Shell32!SHEmptyRecycleBinW T1070.004 - Indicator Removal: File Deletion Empty Recycle Bin.
It checks for the presence of DumpStack.log, reads and decodes the file into payload_shellcode_layer_1... Stage‑2 begins by XOR‑decoding and calling RtlDecompressBuffer to produce the Charon PE in memory.
Kernel32!CreateMutexW (mutex: OopsCharonHere ) T1480.002 - Execution Guardrails: Mutual Exclusion Single instance control.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... "The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload."
chage -- /etc/shadow ... атакующий через pidfd_getfd() перехватывает FD и читает содержимое - хеши паролей всех локальных пользователей.
Утечка credentials: /etc/shadow и SSH host keys ... атакующий через pidfd_getfd() перехватывает FD и читает содержимое - хеши паролей всех локальных пользователей ... /usr/lib/openssh/ssh-keysign ... атакующий перехватывает дескриптор - и вот у него приватные ключи хоста.
CNG/CryptoAPI (e.g., BCryptGenRandom ; custom X25519+ChaCha20 implementation) T1486 - Data Encrypted for Impact Generate 32‑byte private key → ECDH with attacker pubkey → derive 256‑bit key → modified ChaCha20 → partial encryption + 72‑byte footer.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... Further defense tactics that organizations can adopt to combat advanced ransomware tactics include ensuring that EDR and antivirus agents are running with capabilities that prevent malware from disabling, tampering with, or uninstalling the security solutions.
Advapi32!OpenSCManagerW / OpenServiceW / ControlServiceW T1489 - Service Stop & T1562.001 - Impair Defenses: Disable or Modify Tools... Kernel32!OpenProcess / TerminateProcess T1562.001 - Impair Defenses: Disable or Modify Tools Terminate AV/EDR‑related processes.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware targeting Middle East public sector and aviation; uses APT-like evasion (DLL sideloading, process injection) (per summary).
Sophisticated ransomware delivered through a multi-stage loader chain. It uses DLL sideloading, shellcode staging, process hollowing into svchost.exe, anti-debugging, anti-recovery and defense-impairment actions, enumerates local and network shares, encrypts files in memory using a hybrid Curve25519/X25519 plus ChaCha20 scheme, appends a 72-byte footer, renames files with the .Charon extension, and drops a ransom note.
CHARON is a ransomware family that uses advanced evasion techniques such as DLL sideloading and process injection. It targets public sector and aviation organizations in the Middle East, disables security services, deletes backups, and customizes ransom notes for each victim. It shows technical overlap with the China-linked Earth Baxia group.
Ransomware using advanced persistent threat (APT) techniques to target enterprises in the Middle East.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.