---
title: "Discussion on \"APT Earth Baxia - Charon Ransomware:  An In-Depth Analysis\" | Hashnode"
description: "Discussion on \"APT Earth Baxia - Charon Ransomware:  An In-Depth Analysis\". Charon is a sophisticated ransomware strain associated with the Earth Baxia APT group. This report dissects its TTPs end‑to‑end: DLL sideloading, multi‑layer shellcode staging, process hollowing into svchost.exe, pre‑encryption anti‑recovery/defense‑..."
url: "https://hashnode.com/posts/apt-earth-baxia-charon-ransomware-an-in-depth-analysis/694fbb376eb2e3ab8ba47d79"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [APT Earth Baxia - Charon Ransomware: An In-Depth Analysis](https://bluecyber.hashnode.dev/apt-earth-baxia-charon-ransomware-an-in-depth-analysis?utm_source=hashnode&utm_medium=feed)

Charon is a sophisticated ransomware strain associated with the Earth Baxia APT group. This report dissects its TTPs end‑to‑end: DLL sideloading, multi‑layer shellcode staging, process hollowing into svchost.exe, pre‑encryption anti‑recovery/defense‑...

Dec 27, 2025 · 14 min read · bluecyber.hashnode.dev  
Updated Jan 9  
Read the article

-   [#malware](https://hashnode.com/tag/malware)
-   [#reverse-engineering](https://hashnode.com/tag/reverse-engineering)
-   [#security](https://hashnode.com/tag/security)
-   [#apt](https://hashnode.com/tag/apt)
-   [#ransomware](https://hashnode.com/tag/ransomware)
-   [#ida](https://hashnode.com/tag/ida)
-   [#malware-analysis](https://hashnode.com/tag/malware-analysis)

## Written by

[Nigmaz](https://hashnode.com/@nigmao)

@nigmao

  
[View profile](https://hashnode.com/@nigmao)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.