A threat cluster is using a customized variant of the Java-based Adwind RAT to deploy a ransomware payload known as JanaWare. The activity is primarily aimed at users in Turkey, with the malware performing locale and IP-based checks before continuing execution. Researchers have tracked related samples since 2020, while more recent command-and-control activity indicates the campaign remained active in 2025.
The Acronis TRU team examined malicious JAR files distributed through phishing emails that were launched through Outlook and Chrome. Once executed, the infection chain moved to javaw.exe , which loaded the tailored Adwind RAT strain and later deployed the JanaWare ransomware component. Analysis also showed the use of polymorphic JAR files, Tor-based command-and-control infrastructure, and a ransom note written in Turkish.
Defenders should block the malicious domain elementsplugin.duckdns.org and any associated ports, while restricting the execution of unsigned Java JAR files across the environment. Security teams should also watch for suspicious chrome.exe command lines tied to downloads from Google Drive and strengthen email protections against phishing delivery. Endpoint defenses should be tuned to identify Adwind RAT behavior as well as suspicious file-encryption activity linked to ransomware execution.
If infection is suspected, isolate affected systems immediately, terminate javaw.exe and any related malicious processes, and capture volatile evidence before shutdown or cleanup. Recovery efforts should prioritize restoring files from verified clean backups. Incident response teams should also gather available command-and-control telemetry and evaluate whether law enforcement notification is appropriate in cases involving ransom demands or extortion.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An attacker who has gained low‑privilege user access wishes to disable Windows Defender to pave the way for ransomware deployment. Leveraging the signed powershell.exe binary (T1218.001), the attacker runs a one‑liner that disables real‑time monitoring and disables cloud‑based protection, thereby weakening the endpoint’s defensive posture.
The command line contains the Set-MpPreference keyword, which matches the detection rule’s selection criteria.
Regression Test Script: The following self‑contained PowerShell script reproduces the attack and ensures the telemetry is generated.
Cleanup Commands: Restore the original Defender configuration to avoid leaving the endpoint exposed.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
