JanaWare Ransomware Targets Turkish Users via Adwind RAT

Researchers uncovered a targeted, lower-profile ransomware campaign aimed at Turkish users that leverages a customized Adwind RAT to deploy a Java-based JanaWare ransomware module. The malware uses heavy obfuscation (Stringer, Allatori, custom class loaders, FilePumper), checks system language and IP geolocation before payload execution, weakens Windows defenses via PowerShell and registry changes, communicates over Tor to send AES encryption keys to C2, and drops Turkish-language ransom notes named with the fixed phrase "ONEMLI_NOT."