This threat involves a customized variant of the Adwind Java RAT with polymorphic capabilities used to deliver JanaWare ransomware. The campaign specifically targets Turkish users by checking system locale and external IP geolocation. Infection vectors include phishing emails with malicious Java archive attachments hosted on Google Drive. The ransomware encrypts files using AES encryption after disabling Windows security features. It uses obfuscators such as Stringer and Allatori and implements file pumping for polymorphism to avoid detection. Communication with attackers occurs over Tor networks, and ransom demands range from $200 to $400. Indicators include specific file hashes and domains related to the campaign.

The ransomware encrypts victim files using AES, rendering data inaccessible until ransom payment. It disables Windows security features, increasing the likelihood of successful encryption and persistence. The campaign targets home users and small to medium-sized businesses in Turkey, potentially causing operational disruption and financial loss. Ransom demands are relatively modest but may still impact victims financially. There are no known exploits in the wild beyond this campaign, and no official patch or remediation is available as this is malware delivered via phishing rather than a software vulnerability.

No official patch or fix is available since this is malware delivered via phishing. Mitigation should focus on user awareness to avoid phishing emails, blocking malicious Java archive attachments, and restricting execution of unauthorized Java applications. Network defenses should monitor and block known malicious domains and IPs associated with the campaign. Endpoint security solutions should be updated to detect obfuscation techniques used by this malware. Since the ransomware disables Windows security features, ensuring security software is tamper-resistant and employing application whitelisting can help. Victims should avoid paying ransom and instead restore data from backups if available.