Charon Ransomware Emerges With APT-Style Tactics

Trend Micro researchers observed a new ransomware family named Charon deployed in targeted attacks against public sector and aviation organizations in the Middle East. The campaign uses advanced APT-style techniques—DLL sideloading (Edge.exe loading a malicious msedge.dll/SWORDLDR), multi-stage encrypted payloads hidden in DumpStack.log, and process injection into svchost.exe—allowing evasion of EDR and rapid network compromise; researchers note overlaps with Earth Baxia tradecraft but cannot definitively attribute the activity and recommend multilayered defenses to harden against DLL sideloading, process injection, and tampering of endpoint security.