New ‘JanaWare’ ransomware targeting Turkish citizens as cybercriminal ecosystem fragments

Acronis researchers describe JanaWare, a Turkey-focused ransomware campaign active since 2020 that infects home users and small-to-medium businesses primarily through phishing emails and malicious Java archives; the malware leverages an Adwind component with heavy obfuscation and enforces system locale and IP geolocation checks so it executes only on devices configured for Turkey. Ransom notes are in Turkish, demands are low (~$200–$400), and victims are directed to contact operators via qTox, with the campaign's narrow geographic focus helping it remain under the radar.