New JanaWare ransomware targets Turkey via Adwind RAT

[Khushal]

Content source

https://www.acronis.com/en/tru/posts/new-janaware-ransomware-targets-turkey-via-adwind-rat/

The Acronis TRU team identified a threat cluster leveraging a customized Adwind (Java RAT) variant with polymorphic characteristics to deliver a ransomware module, tracked as ‘JanaWare.' Analysis of malware samples, infrastructure and telemetry indicates the campaign is likely focused on Turkish users.

New JanaWare ransomware targets Turkey via Adwind RAT

The Acronis TRU team identified a threat cluster leveraging a customized Adwind (Java RAT) variant with polymorphic characteristics to deliver a ransomware module, tracked as ‘JanaWare.' Analysis of malware samples, infrastructure and telemetry indicates the campaign is likely focused on Turkish...

www.acronis.com

 

[Bot]

This looks like a legitimate security research summary, but the linked article alone is not enough to independently confirm the full scope of the campaign.

What stands out

• The report describes a customized Adwind/Java RAT being used as an infection stage before deploying ransomware.
• Polymorphic behavior usually means the malware changes its appearance between samples, which can make static detection less reliable.
• If the telemetry is accurate, the reported focus on Turkish users suggests a regionally targeted campaign rather than broad opportunistic spam.

Why this matters

Using a RAT before ransomware is significant because it can give the attacker time to:

• Profile the victim
• Maintain persistence
• Steal data
• Choose when to deploy the ransomware payload

That generally makes the attack more dangerous than a simple one-stage ransomware dropper.

A note of caution

It is still best to treat vendor attribution and campaign scoping carefully until there is broader confirmation from additional researchers, telemetry, or public IOCs. I cannot verify from the quote alone how widespread the activity is or whether “JanaWare” will become a commonly adopted family name.

Practical takeaway

For defenders, the useful next steps are straightforward:

• Review the IOCs and behavioral indicators from the Acronis report
• Watch for suspicious Java-based executions, especially from unexpected archive or email-delivered files
• Check for persistence mechanisms and outbound connections associated with RAT activity before any encryption event
• Make sure offline or otherwise protected backups are available and tested
• Harden email filtering and restrict unnecessary Java execution where possible

Overall, the report is worth attention because the Adwind-to-ransomware chain is plausible and operationally meaningful, even if some campaign details should be treated as provisional until independently corroborated.

Source

• New JanaWare ransomware targets Turkey via Adwind RAT

 

[Andy Ful]

The attack requires the Java Runtime Environment, which is currently not common on home computers. It is more common in businesses.
However, I am not sure about Turkey.