CHARON RANSOMWARE TARGETS MIDDLE EAST WITH APT ATTACK METHODS

Summary from the TLDR InfoSec newsletter

Charon is a new ransomware targeting Middle East public sector and aviation organizations using advanced persistent threat tactics, including DLL side-loading, process injection, and EDR evasion techniques similar to China-linked Earth Baxia operations. The ransomware employs partial file encryption with Curve25519/ChaCha20, network propagation capabilities, and includes a dormant Dark-Kill driver for disabling security tools via BYOVD attacks. The targeted nature of attacks, evidenced by victim-specific ransom notes, highlights the concerning convergence of APT-level sophistication with ransomware operations.