Charon Ransomware Targets Middle East Sectors with Advanced Evasion Techniques
August 13, 2025
Endpoint Security / Cybercrime
Recent investigations by cybersecurity experts have unveiled a new wave of malicious activity involving a previously unknown ransomware variant named Charon. This campaign has specifically targeted the public sector and aviation industry across the Middle East. According to analysis from Trend Micro, the threat actor behind this operation is utilizing sophisticated tactics akin to those seen in advanced persistent threat (APT) groups, including techniques such as DLL side-loading and process injection, which effectively evade modern endpoint detection and response (EDR) tools.
The methodology associated with this attack draws parallels with tactics linked to the China-affiliated hacking group Earth Baxia. Previous activities attributed to this group involved targeting governmental organizations in Taiwan and the broader Asia-Pacific region. Earth Baxia exploited a security vulnerability in OSGeo GeoServer’s GeoTools to deploy a backdoor dubbed EAGLEDOOR, utilizing legitimate software files to conceal their malicious actions. Notably, the current attack hinges on manipulating a browser-related file, Edge.exe, originally named cookie_exporter.exe, to facilitate the side-loading process.
The intent behind the Charon ransomware campaign remains to disrupt critical services and potentially extort public sector organizations and aviation entities. As these sectors are essential to the functioning of society and the economy, the implications of such attacks can be far-reaching. Cybersecurity professionals are particularly concerned given the attention this campaign has drawn, with its use of APT-level techniques indicating a significant evolution in the tactics employed by cybercriminals.
Employing tactics categorized under the MITRE ATT&CK framework, the attacker likely achieved initial access through sophisticated social engineering or exploit techniques. Once inside the target environment, persistence was maintained through methods like process injection to ensure continued access. Furthermore, privilege escalation tactics may have been deployed to gain higher-level permissions within the compromised networks, allowing for broader access to sensitive data and critical infrastructure.
The ongoing nature of cyber threats in this region necessitates vigilance among organizations in the public sector and aviation industries. As attackers increasingly adopt complex strategies, it is imperative for business owners to not only invest in robust cybersecurity measures but also to foster a culture of awareness and preparedness among their teams.
This incident serves as a reminder of the growing sophistication of ransomware threats and highlights the importance of adhering to comprehensive cybersecurity practices. Organizations are encouraged to review their incident response plans and ensure they are equipped to mitigate against such advanced attacks. The landscape of cyber threats continues to evolve, and remaining informed is crucial to safeguarding critical operations.