Haron is a ransomware-as-a-service group mimicking Avaddon and built on the Thanos ransomware builder.
Haron is a ransomware-as-a-service cybercrime group that emerged in July 2021. It primarily targets enterprise organizations. The group mimics the ransom notes and leak site structure of the defunct Avaddon ransomware and is built on the Thanos ransomware builder. Defenders should be prepared for its six-day negotiation window, ransom notes, and data leak tactics.
Haron appeared in July 2021 as a ransomware-as-a-service operation heavily borrowing from the defunct Avaddon ransomware (copying ransom notes and leak site structure) and built on the Thanos ransomware builder, targeting enterprise organizations with a six-day negotiation window.
Haron is a ransomware-as-a-service cybercrime group that emerged in July 2021.
The Haron group is built on the Thanos ransomware builder.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.