New JanaWare Ransomware Targets Turkish Users Through Customized Adwind RAT

Acronis analysts identified a campaign targeting users in Turkey that uses a customized Adwind remote access trojan to establish persistence and profile victims, then selectively deploys a newly observed ransomware strain dubbed JanaWare; the attackers use localized phishing lures, multi-stage loaders, C2-based payload delivery, and basic anti‑analysis and backup‑disabling techniques to maximize impact on personal users and small businesses.