MalwarePublished 12 Aug 2025

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

Source AlienVault OTX General

Description

A new ransomware family called Charon has been identified, targeting the Middle East's public sector and aviation industry. The attack employs sophisticated APT-style techniques, including DLL sideloading, process injection, and anti-EDR capabilities. Charon uses a multistage payload extraction technique and a hybrid cryptographic scheme combining Curve25519 with ChaCha20 cipher. The ransomware exhibits network propagation capabilities and includes a dormant anti-EDR component. The campaign demonstrates a concerning trend of ransomware operators adopting APT-level techniques, posing an elevated risk to organizations. Defending against Charon requires a multilayered approach, including hardening against DLL sideloading, limiting lateral movement, strengthening backup capabilities, and reinforcing user awareness.

Impact

For European organizations, the emergence of Charon ransomware represents a significant threat, especially for sectors analogous to those targeted in the Middle East, such as public sector entities and aviation companies. The use of advanced evasion techniques and network propagation capabilities means that once inside a network, Charon can spread rapidly, encrypting critical systems and data, leading to operational disruption, financial losses, and reputational damage. The hybrid cryptographic scheme complicates decryption efforts, increasing the likelihood that victims must pay ransoms or suffer permanent data loss. The dormant anti-EDR features pose challenges for detection and incident response teams, potentially allowing the ransomware to remain undetected for extended periods. European organizations with complex IT environments and interconnected systems are particularly vulnerable to lateral movement exploitation. Additionally, the adoption of APT-level tactics by ransomware actors signals a shift towards more targeted, persistent, and sophisticated attacks, requiring European enterprises to elevate their defensive postures. The aviation sector in Europe, a critical infrastructure component, could face severe operational and safety risks if targeted. Public sector organizations may also be at risk of data breaches and service interruptions, impacting citizens and government functions.

Defensive guidance

1. Implement strict application whitelisting and monitor for DLL sideloading attempts by validating DLL signatures and origins. 2. Employ advanced endpoint protection solutions capable of detecting process injection and anomalous behaviors associated with anti-EDR techniques. 3. Enforce network segmentation and zero-trust principles to limit lateral movement, including restricting administrative privileges and using micro-segmentation in critical environments. 4. Maintain robust, immutable, and regularly tested backups stored offline or in isolated environments to ensure recovery without paying ransom. 5. Conduct targeted user awareness training focused on phishing and social engineering tactics, as initial infection vectors often involve user interaction. 6. Monitor network traffic for unusual propagation patterns and implement intrusion detection systems tuned to detect lateral movement techniques. 7. Regularly update and patch systems to reduce attack surface, even though no specific CVEs are currently linked to Charon. 8. Establish incident response plans that include rapid containment and eradication procedures tailored to sophisticated ransomware threats. 9. Collaborate with threat intelligence sharing communities to stay informed about emerging indicators and tactics related to Charon and Earth Baxia.

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 3

Community reviews

Description

AI analysisMachine-generated, updated 12 Aug 2025, 16:19 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Hashes 3

Community reviews

Related threats