Cyberdudebivash

Executive Summary

A newly observed ransomware family, Charon, is conducting targeted campaigns against public-sector and aviation organizations in the Middle East. Unlike smash-and-grab RaaS crews, Charon blends APT-grade tradecraft—notably DLL sideloading, process injection, anti-EDR measures, and multi-stage encrypted payloads—with classic ransomware business impact. Victim ransom notes are customized per organization, indicating deliberate selection over opportunistic spraying. The Record from Recorded FutureThe Hacker NewsTrend Micro

What’s New

• Target set: Middle-East public & aviation sectors. The Record from Recorded FutureThe Hacker News
• APT-style TTPs: DLL sideloading via a signed Edge.exe (originally cookie_exporter.exe) to load a malicious msedge.dll (SWORDLDR), which decrypts and launches the ransomware. Trend Micro
• Defense evasion: Service/EDR tampering, shadow copy deletion, multithreaded/partial encryption to speed impact; BYOVD capability observed (driver compiled from Dark-Kill), though not always triggered. The Hacker News
• Attribution note: Overlaps with Earth Baxia tooling/flow, but no definitive attribution (could be imitation or independent convergence). The Record from Recorded FutureThe Hacker News

Attack Chain (Reconstructed)

1. Initial foothold
   Delivery not fully disclosed; telemetry and historical Earth Baxia playbooks suggest spear-phishing is plausible. The Record from Recorded Future
2. Execution & Loader Stage
   A legitimate Edge.exe (signed binary, originally cookie_exporter.exe) is executed to sideload a malicious msedge.dll (aka SWORDLDR). This DLL decrypts an intermediate blob (DumpStack.log) containing encrypted shellcode. Trend Micro
3. Decryption & Injection
   The decrypted shellcode unpacks the final Charon PE and injects into svchost.exe for masquerading and EDR evasion. Trend Micro
4. Pre-encryption disruption
   Terminates security services/processes, deletes shadow copies, empties Recycle Bin, and prepares multithreaded encryption. Trend Micro
5. Encryption & Ransom note
   • Appends “.Charon” extension; writes an infection marker (hCharon is enter to the urworld!) to encrypted files.
   • Victim-named ransom notes list encrypted data and payment instructions. Trend MicroThe Record from Recorded Future

Crypto & Internals

• Hybrid scheme: Curve25519 ECDH to derive shared secret + modified ChaCha20 for file content encryption; 72-byte per-file footer holds victim public key/metadata. Trend Micro
• Operator controls: Command-line switches like --shares, --paths, --sf (encrypt shares first) to tune impact paths/order; mutex: OopsCharonHere. Trend Micro

MITRE ATT&CK Mapping (selected)

• Initial Access: Phishing (T1566) (assessed). The Record from Recorded Future
• Execution: DLL Sideloading (T1574.002). Trend Micro
• Defense Evasion: BYOVD (T1068/T1562), Impair Defenses (T1562.001), Masquerading via svchost (T1036). The Hacker NewsTrend Micro
• Credential Access/Discovery: (likely) LSASS/process discovery during lateral movement (monitor).
• Impact: Data Encrypted for Impact (T1486). Trend Micro

Detection & Hunting Playbook

High-signal process chains

• Signed binary → non-standard DLL → svchost.exe child
  • e.g., ...\Edge.exe spawning load of msedge.dll (unusual path/name), then spawning/injecting into svchost.exe. Alert on Edge.exe executing from non-Program Files paths or adjacent to msedge.dll. Trend Micro

Eventing/telemetry to collect

• Image load events for DLLs next to signed EXEs; EDR/AV service stop attempts; VSS shadow copy deletions; spikes in SMB share enumeration preceding encryption. Trend Micro

Sample Sigma (conceptual)

title: Suspicious Edge.exe → svchost.exe with Adjacent msedge.dll
logsource: { category: process_creation, product: windows }
detection:
  sel1:
    ParentImage|endswith: '\Edge.exe'
  sel2:
    Image|endswith: '\svchost.exe'
  sel3:
    CommandLine|contains|all: ['msedge.dll','DumpStack.log']
condition: sel1 and sel2 and sel3
level: high

Rationale derived from Trend Micro’s observed sideloading chain. Trend Micro

YARA (lightweight heuristic)

Focus on the “.Charon” extension write + marker string in tail of files; pair with process ancestry to reduce noise. Trend Micro

Hardening & Response Checklist (Do This Today)

1. Block sideloading paths: restrict where signed apps can load DLLs; enforce WDAC/AppLocker; monitor app directories for new DLL drops next to signed binaries. Trend Micro
2. EDR anti-tamper: ensure self-protection and service lock; alert on service stops / driver loads that match BYOVD patterns (e.g., unsigned or rare drivers like Dark-Kill derivatives). The Hacker News
3. Shares first risk: because Charon can prioritize network shares (--shares, --sf), lock down ADMIN$, trim excessive share permissions, and segment backup shares. Trend Micro
4. Backups: maintain immutable/offline copies; test restores assuming shadow copies are gone. Trend Micro
5. User awareness + macro hygiene: reinforce spear-phishing defenses while initial vector remains under investigation. The Record from Recorded Future

Analyst IOCs & Artifacts (from reporting)

• File extension: .Charon
• Infection marker: hCharon is enter to the urworld! (file tail)
• Mutex: OopsCharonHere
• Loader/DLL names observed: Edge.exe (orig. cookie_exporter.exe) + msedge.dll aka SWORDLDR
• Injected process: svchost.exe
  (Use these as pivots; always verify against your environment baselines.) Trend Micro

Attribution Outlook

There are notable tactical overlaps with Earth Baxia, a China-linked espionage group, but researchers stress this could reflect direct use, false flag, or independent mimicry. Bottom line: no firm attribution yet—defenders should focus on TTPs, not labels. The Record from Recorded FutureThe Hacker News

CyberDudeBivash Verdict

Charon is a wake-up call: ransomware crews are graduating to APT-grade delivery while keeping the fastest path to business impact. If you haven’t hardened DLL search paths, share permissions, and EDR anti-tamper, you’re betting the house on luck.

Published by CyberDudeBivash — Your trusted partner for real-time threat intel and pragmatic defense.
🔗 cyberdudebivash.com • Follow: #CyberDudeBivash #ThreatIntel #Ransomware #APT #EDR #IncidentResponse