New ransomware targets Turkey via Adwind RAT

A threat cluster has been identified leveraging a customized Adwind (Java RAT) variant with polymorphic characteristics to deliver JanaWare ransomware. The campaign specifically targets Turkish users through geofencing mechanisms that check system locale and external IP geolocation. Active since at least 2020, the operation primarily affects home users and small to medium-sized businesses. Initial access occurs via phishing emails with malicious Java archives distributed through Google Drive links. The ransomware employs AES encryption and communicates over Tor networks, demanding modest ransoms between $200-$400. The malware uses multiple obfuscation techniques including Stringer and Allatori obfuscators, implements file pumping for polymorphism, and disables Windows security features before encryption. Victims are instructed to contact attackers through qTox or dedicated Tor onion sites.

Pulse ID: 69dfa90cbce3255033d01a33
Pulse Link: https://otx.alienvault.com/pulse/69dfa90cbce3255033d01a33
Pulse Author: AlienVault
Created: 2026-04-15 15:04:44

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Email #Encryption #Google #ICS #InfoSec #Java #Malware #OTX #Onion #OpenThreatExchange #Phishing #RAT #RansomWare #SMS #Turkey #Turkish #Windows #bot #AlienVault