New ransomware targets Turkey via Adwind RAT

A threat cluster has been identified leveraging a customized Adwind (Java RAT) variant with polymorphic characteristics to deliver JanaWare ransomware. The campaign specifically targets Turkish users through geofencing mechanisms that check system locale and external IP geolocation. Active since at least 2020, the operation primarily affects home users and small to medium-sized businesses. Initial access occurs via phishing emails with malicious Java archives distributed through Google Drive links. The ransomware employs AES encryption and communicates over Tor networks, demanding modest ransoms between $200-$400. The malware uses multiple obfuscation techniques including Stringer and Allatori obfuscators, implements file pumping for polymorphism, and disables Windows security features before encryption. Victims are instructed to contact attackers through qTox or dedicated Tor onion sites.

• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• Inside a brand deal scam targeting YouTube creatorsCampaign2026-10-12
• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• Behind the Connect Button: The Fake AI Ads CampaignCampaign2026-10-07
• PureRAT and PureLogs Campaign Targeting Japanese OrganizationsCampaign2026-09-25