Charon Ransomware Strikes Middle East: A New Era of APT-Level Ransomware Attacks

In August 2025, the Charon ransomware attack has been detected targeting critical sectors across the Middle East, marking a new phase of sophisticated ransomware blending nation-state tactics with extortion. This campaign, orchestrated by a novel ransomware strain named Charon, represents a dangerous evolution in ransomware tactics by blending traditional ransomware with advanced persistent threat (APT) techniques.

The Anatomy of the Charon Ransomware Attack

Charon ransomware uses sophisticated methods previously seen in government-backed cyber espionage groups, such as those linked to the China-based Earth Baxia APT group. The attack begins with a unique DLL sideloading technique: a legitimate browser-related executable (originally cookie_exporter.exe, masquerading as Edge.exe) is exploited to load a malicious DLL (msedge.dll, or SWORDLDR). This DLL then decrypts and injects the ransomware payload into a trusted Windows process (svchost.exe), thus evading detection by endpoint detection and response (EDR) tools.

Further complexity is introduced by a multi-layer payload extraction method involving an encrypted DumpStack.log file that contains hidden shellcode, which is decrypted in stages until the ransomware executable is fully unpacked.

Advanced EDR Evasion and Ransomware Persistence

Charon disables anti-malware and security services, ensuring that defenses are crippled before launching encryption. It terminates ongoing processes related to security, deletes all shadow copies and backups, and even empties Recycle Bin data—maximizing damage and especially hindering recovery efforts.

Targeted and Customized Extortion

Unlike mass ransomware campaigns, Charon delivers ransom notes that are customized for each victim, explicitly naming the targeted organization. This psychological approach increases pressure and urgency, pushing victims toward quick payments to avoid public embarrassment and data exposure.

Impacted Sectors and Regional Importance

The Middle East’s public sector and aviation industry are primary targets for this campaign, reflecting the geopolitical and economic value cybercriminals attribute to these critical infrastructures. Disruptions in these sectors can create operational downtime, significant financial losses, and broader impacts—affecting government services and air safety.

Why Charon Ransomware Is a Game Changer

• Blend of APT Stealth and Ransomware Payloads: Employs techniques borrowed from advanced nation-state groups.
• BYOVD Capability: Can deploy vulnerable drivers to disable EDR solutions, although this feature has not yet been observed in active attacks.
• Efficient Encryption: Uses fast Curve25519 and ChaCha20 algorithms for partial file locking.
• Network Propagation: Spreads across accessible shares and skips admin shares for stealth.
• Multi-threaded Encryption: Locks files quickly, minimizing the window for defense or recovery.

Defending Against Charon and Similar Threats

Organizations should:

• Deploy robust EDR tools and monitor for suspicious DLL sideloading.
• Audit network shares and restrict exposure.
• Train staff to recognize and report spear-phishing and social engineering.
• Keep all systems and third-party applications updated and patched.
• Maintain and regularly test independent, offline backups of critical data.

The Bigger Picture: Ransomware Trends in 2025

Ransomware attacks have surged in precision and frequency, with incidents up 53% year-on-year. Cybercriminals now use APT tactics, exploit overlooked surfaces like IoT and cloud environments, and target critical infrastructure for maximum impact. Dominant groups such as Clop, RansomHub, and Akira highlight the industrialization of ransomware, while novel threats like Charon merge cyberespionage and extortion.

Final Thoughts

The Charon ransomware campaign marks a pivotal shift in cyberattack sophistication, blending stealth, advanced payload delivery, and tailored psychological extortion. In geopolitically sensitive regions like the Middle East, the stakes are higher than ever. Organizations must remain vigilant—leveraging advanced security technology, enforcing airtight backup strategies, and promoting a culture of cybersecurity awareness.

Stay informed with HackerVault.tech as we continue to deliver in-depth analysis, up-to-date threat intelligence, and actionable security guidance to protect your digital assets.