JanaWare Ransomware Targets Turkey Using Adwind RAT

• •JanaWare ransomware targets Turkish users via phishing emails with malicious JAR attachments.
• •The malware employs advanced obfuscation and geofencing to restrict operations to Turkey.
• •Ransom demands range from $200 to $400, indicating a strategy focused on quick, local payouts.

The JanaWare ransomware campaign has emerged, targeting users in Turkey through a customized variant of the Adwind RAT. The malware is distributed via phishing emails containing malicious JAR files, which, when executed, encrypt user data and display ransom notes in Turkish. The campaign has been active since around 2020, primarily affecting small to medium-sized businesses rather than large enterprises. Ransom demands range from $200 to $400, indicating a low-value, high-volume attack strategy. JanaWare employs advanced obfuscation techniques and geofencing to restrict its operations to Turkish systems, enhancing its evasion of detection. The malware disables security features like Microsoft Defender and deletes shadow copies before initiating encryption. Researchers have identified the use of multiple obfuscators, including Stringer and Allatori, to complicate static analysis. Victims are instructed to communicate with attackers through secure channels like qTox or Tor-based sites. The campaign's persistence and regional focus underscore its potential threat to Turkish cybersecurity.