New JanaWare Ransomware Targets Turkish Users Through Customized Adwind RAT

Cybersecuritynews •Tushar Subhra Dutta • April 15, 2026

A new ransomware family called JanaWare has begun targeting computer users in Turkey, relying on a customized version of the Adwind remote access trojan (RAT) to gain a foothold on victims’ systems. This campaign stands out because it combines a known cross‑platform RAT with fresh ransomware logic and a distribution model tailored to local users, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JanaWare Ransomware Targets Turkey Using Adwind RAT The JanaWare ransomware campaign has emerged, targeting users in Turkey through a customized variant of the Adwind RAT. The malware is distributed via phishing emails containing malicious JAR files, which, when executed, encrypt user data and display ransom notes in Turkish. The campaign has been active since around 2020, primarily affecting small to medium-sized businesses rather than large enterprises. Ransom demands range from $200 to $400, indicating a low-value, high-volume attack strategy. JanaWare employs advanced obfuscation techniques and geofencing to restrict its operations to Turkish systems, enhancing its evasion of detection. The malware disables security features like Microsoft Defender and deletes shadow copies before initiating encryption. Researchers have identified the use of multiple obfuscators, including Stringer and Allatori, to complicate static analysis. Victims are instructed to communicate with attackers through secure channels like qTox or Tor-based sites. The campaign's persistence and regional focus underscore its potential threat to Turkish cybersecurity. 9 sources 70

Extracted Entities

New JanaWare Ransomware Targets Turkish Users Through Customized Adwind RAT

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

Ransomware Groups (1)