Acronis Researchers Link JanaWare Ransomware to Customized Adwind RAT Campaign in Turkey
Summary
Acronis TRU researchers describe a JanaWare campaign active since at least 2020, linking it to a customized Adwind RAT. The reported operation targets Turkish users through phishing and uses geofencing, obfuscation, defense evasion, and AES encryption.
Key points
- Acronis TRU researchers link JanaWare to a customized, polymorphic Adwind RAT and report activity from at least 2020 into late 2025.
- The reported primary infection method is phishing that leads users to download malicious Java archives, often hosted on cloud storage.
- The malware reportedly checks language, locale, and external IP geolocation to restrict execution to systems matching Turkish parameters.
- Researchers identified Stringer and Allatori obfuscation, along with self-modification that adds random data to Java archives and changes file hashes.
- Before encryption, the malware reportedly attempts to disable Microsoft Defender, suppress security alerts, remove Volume Shadow Copies, and interfere with Windows Update.
- A secondary module uses AES encryption and communicates with command-and-control infrastructure over Tor; Turkish-language ransom notes direct victims to contact the attackers through qTox or Tor-based sites.
- Observed ransom demands reportedly range from $200 to $400.
Article Details
- Attack Vectors
- Phishing emails link users to Java archive files, which are downloaded and executed using Java; researchers report that the payload is often hosted on cloud storage.
- The malware uses geofencing based on system language, locale settings, and external IP geolocation to halt activity on systems that do not match Turkish criteria.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware uses Stringer, Allatori, custom obfuscation, and polymorphic changes to hinder analysis and detection.T1105 · Ingress Tool TransferA browser downloads the malicious Java archive after the victim follows a phishing link.T1204.001 · Malicious LinkVictims are lured into clicking links that lead to the Java archive download.T1486 · Data Encrypted for ImpactA secondary module uses AES encryption to encrypt files on affected systems.T1490 · Inhibit System RecoveryThe malware removes recovery mechanisms, including Volume Shadow Copies, before encryption.T1562.001 · Disable or Modify ToolsBefore encryption, the malware attempts to disable Microsoft Defender and suppress security alerts.T1566.002 · Spearphishing LinkThe campaign uses phishing emails containing links to malicious Java archive downloads.T1614.001 · System Language DiscoveryThe malware checks system language and locale settings before proceeding.
Malware
Adwind RATResearchers at Acronis TRU identified a long-running JanaWare campaign active since at least 2020 that targets users in Turkey using a customized, polymorphic Adwind RAT and extensive obfuscation to evade detection.JanaWareResearchers at Acronis TRU identified a long-running JanaWare campaign active since at least 2020 that targets users in Turkey using a customized, polymorphic Adwind RAT and extensive obfuscation to evade detection.
Products
Microsoft Defender Antimalware PlatformThe threat disables Microsoft Defender and recovery mechanisms, then deploys an AES encryption module that communicates over Tor while demanding modest ransoms.Microsoft OutlookA phishing email is opened in Microsoft Outlook, followed by a browser session that downloads the malicious file.
Tools
AllatoriThe malware uses polymorphism and obfuscation tools like Stringer and Allatori to hinder detection.qToxThese notes are written in Turkish and instruct victims to contact the attackers through encrypted communication channels such as qTox or Tor-based websites.StringerThe malware uses polymorphism and obfuscation tools like Stringer and Allatori to hinder detection.TorThe operation spreads via phishing-delivered Java archives, employs geofencing and Turkish-language ransom notes, disables security controls before delivering an AES encryption module, and communicates over Tor.