Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new ransomware family called Charon has been identified, targeting the Middle East's public sector and aviation industry. The attack employs sophisticated APT-style techniques, including DLL sideloading, process injection, and anti-EDR capabilities. Charon uses a multistage payload extraction technique and a hybrid cryptographic scheme combining Curve25519 with ChaCha20 cipher. The ransomware exhibits network propagation capabilities and includes a dormant anti-EDR component. The campaign demonstrates a concerning trend of ransomware operators adopting APT-level techniques, posing an elevated risk to organizations. Defending against Charon requires a multilayered approach, including hardening against DLL sideloading, limiting lateral movement, strengthening backup capabilities, and reinforcing user awareness.

Charon is a newly identified ransomware family that leverages advanced persistent threat (APT)-style techniques attributed to the Earth Baxia adversary group. It primarily targets enterprises in the Middle East's public sector and aviation industry but demonstrates capabilities that could pose risks globally. The ransomware employs sophisticated evasion tactics such as DLL sideloading, which allows it to load malicious DLLs under the guise of legitimate processes, and process injection to stealthily execute code within trusted processes. It also includes anti-Endpoint Detection and Response (EDR) mechanisms, including a dormant anti-EDR component that can activate to evade detection tools. Charon uses a multistage payload extraction technique, complicating detection and analysis, and employs a hybrid cryptographic scheme combining Curve25519 for key exchange and ChaCha20 for encryption, ensuring strong cryptographic protection of victim data. The ransomware exhibits network propagation capabilities, enabling it to spread laterally within compromised networks, increasing its impact. The campaign reflects a concerning evolution where ransomware operators adopt sophisticated APT-level tactics, increasing the complexity and potential damage of attacks. Defending against Charon requires a multilayered security approach focusing on hardening systems against DLL sideloading, restricting lateral movement through network segmentation and strict access controls, enhancing backup and recovery strategies to mitigate ransomware impact, and reinforcing user awareness to prevent initial infection vectors such as phishing. Indicators of compromise include specific file hashes that can be used for detection and response. Although currently observed primarily in the Middle East, the advanced techniques and targeting of critical sectors like aviation suggest a broader potential threat landscape.

Detailed information about New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises. Get real-time updates, technical details, and mitigation

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises - Live Threat Intelligence - Threat Radar | OffSeq.com

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

Sarcoma Ransomware, first detected in October 2024, has rapidly become a major cybersecurity threat, targeting high-value companies across industries. It uses advanced tactics like zero-day exploits and RMM tools for network discovery and credential theft. The group has impacted organizations in various countries, with the USA, Italy, and Canada being the most affected. Sarcoma employs sophisticated encryption techniques, combining RSA and ChaCha20, and has versions for both Windows and Linux systems. The malware includes network propagation capabilities and anti-recovery measures for hypervisor systems. Notably, it avoids infecting systems with Uzbek keyboard layouts, suggesting possible origins or affiliations. The group's activities highlight the need for improved cybersecurity measures in organizations worldwide.

Sarcoma Ransomware, first identified in October 2024, is a sophisticated double extortion ransomware campaign targeting high-value organizations across multiple industries. It leverages advanced tactics such as zero-day exploits for initial access and Remote Monitoring and Management (RMM) tools to conduct extensive network reconnaissance and credential theft. The ransomware is designed to infect both Windows and Linux platforms, significantly broadening its attack surface and increasing its potential impact on diverse IT environments. Sarcoma employs a hybrid encryption scheme combining RSA asymmetric encryption with ChaCha20 symmetric encryption, which enhances encryption speed and complexity, making decryption without the attacker’s key extremely difficult. The malware includes network propagation capabilities that enable lateral movement within compromised networks, increasing the scale of infection. It also incorporates anti-recovery mechanisms specifically targeting hypervisor-based systems, preventing restoration from snapshots or backups, which undermines disaster recovery efforts commonly used in virtualized data centers. An operational detail of note is its deliberate avoidance of systems configured with Uzbek keyboard layouts, possibly indicating the threat actor’s origin or geopolitical affiliations. The group uses a double extortion model, not only encrypting data but also exfiltrating sensitive information to pressure victims into paying ransoms under threat of public data leaks. Indicators of compromise include multiple file hashes linked to Sarcoma payloads. Although no public exploits are currently documented, the use of zero-day vulnerabilities and RMM tools indicates a high level of operational sophistication. The campaign has notably impacted organizations in the USA, Italy, and Canada, with Italy’s involvement highlighting a significant European footprint. This ransomware’s multi-platform capabilities, network propagation, and anti-recovery features make it a complex and dangerous threat requiring advanced detection and response strategies.

Detailed information about Sarcoma Ransomware Unveiled: Anatomy of a Double Extortion Gang. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'network propagation'

Filter Threats

Threats Tagged 'network propagation'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility