JanaWare Ransomware Targets Turkish Users Through Adwind RAT Campaign

Researchers at Acronis TRU identified a sustained JanaWare ransomware campaign (active since at least 2020) targeting Turkish users via phishing that delivers a modified Adwind RAT in Java archives; the threat employs geofencing to restrict execution to Turkish systems, uses obfuscation and polymorphism to evade detection, disables security controls before deploying an AES-based encryption module that communicates over Tor, and demands modest ransoms to focus on volume rather than high-value extortion.