Back Therecord.Media

New ‘JanaWare’ ransomware targeting Turkish citizens as cybercriminal ecosystem fragments

Therecord.Media • April 14, 2026

The researchers said the ransomware operation has been ongoing since 2020 and is associated with a strain of malware that enforces execution constraints based on system locale and external IP geolocation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JanaWare Ransomware Targets Turkey Using Adwind RAT The JanaWare ransomware campaign has emerged, targeting users in Turkey through a customized variant of the Adwind RAT. The malware is distributed via phishing emails containing malicious JAR files, which, when executed, encrypt user data and display ransom notes in Turkish. The campaign has been active since around 2020, primarily affecting small to medium-sized businesses rather than large enterprises. Ransom demands range from $200 to $400, indicating a low-value, high-volume attack strategy. JanaWare employs advanced obfuscation techniques and geofencing to restrict its operations to Turkish systems, enhancing its evasion of detection. The malware disables security features like Microsoft Defender and deletes shadow copies before initiating encryption. Researchers have identified the use of multiple obfuscators, including Stringer and Allatori, to complicate static analysis. Victims are instructed to communicate with attackers through secure channels like qTox or Tor-based sites. The campaign's persistence and regional focus underscore its potential threat to Turkish cybersecurity. 9 sources 70

New ‘JanaWare’ ransomware targeting Turkish citizens as cybercriminal ecosystem fragments

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)