JanaWare Ransomware Emerges: Customized Adwind RAT Targets Turkish Users Through Stealthy Java Attacks

Introduction: A Quiet but Dangerous Shift in Ransomware Campaigns

A new ransomware strain known as JanaWare is quietly gaining ground, leveraging a customized version of the Adwind Remote Access Trojan to infiltrate systems. Unlike large-scale ransomware operations that dominate headlines, this campaign operates with precision, focusing primarily on Turkish users and small organizations. Its stealthy nature, combined with advanced obfuscation and targeted delivery methods, makes it particularly concerning for defenders who rely on traditional detection strategies.

Summary of the Original Report

Researchers have identified a modified version of the Adwind Java-based Remote Access Trojan being used to deploy a previously undocumented ransomware family named JanaWare. This campaign appears to be geographically focused, specifically targeting users in Turkey through phishing emails that deliver malicious Java payloads. During sandbox analysis, the malware exhibited unusual behavior compared to typical Adwind samples, eventually dropping a ransom note written in Turkish, indicating deliberate targeting.

The ransom note instructs victims to communicate with attackers using privacy-centric tools such as qTox or through the Tor Browser, where a dedicated .onion website is hosted. This approach highlights the attackers’ effort to maintain anonymity and avoid traceability. Evidence suggests that the operation has been active for some time but has remained largely unnoticed due to its limited geographic scope and relatively low ransom demands compared to major ransomware campaigns.

Technically, the attack chain is sophisticated. The Adwind loader is heavily obfuscated using multiple Java obfuscation tools such as Stringer and Allatori. These layers of protection are reinforced by custom class loaders that complicate reverse engineering efforts. Additionally, a FilePumper component inflates the malware’s file size by inserting rando