Charon

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

Charon is a ransomware family that researchers observed in attacks against Middle Eastern government agencies and the aviation industry.

Stats

First seen: August 2025
Last seen: October 2026

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.Charon.5	AV
Trojan.Ransom.Charon.1	AV
Trojan.Ransom.Charon.4	AV
Win32.Ransomware.Charon	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Charon	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-BACKDOOR charon runtime detection - download file flowbit 1	IPS-SWG
MALWARE-BACKDOOR charon runtime detection - download log flowbit 1	IPS-SWG

References

malpedia.caad.fkie.fraunhofer.de