Stealth Ransomware ‘JanaWare’ Targets Turkish Users Using Adwind RAT and Advanced Evasion Techniques

CyberDefender 7 mins0

Cyber threats continue to evolve in both sophistication and targeting precision. One such emerging threat is a customized ransomware operation built on top of the well-known Adwind RAT. This blog explores the technical anatomy, infection chain, and unique behaviors of what researchers have dubbed JanaWare ransomware.

Overview of the Threat

The investigation began with the discovery of a modified Adwind RAT variant distributed as a Java archive (JAR). Unlike typical samples, this variant demonstrated ransomware capabilities, including dropping a Turkish-language ransom note upon execution .

The attackers rely on anonymous communication channels such as qTox or Tor-based .onion websites. These tools provide end-to-end encryption and decentralization, making it difficult for investigators to trace communications.

Ransom note left by the malware in Turkish, Source : Acronis

Infection Chain: From Phishing to Execution

The attack begins with a classic phishing email. Victims are tricked into clicking malicious links embedded in emails, often leading to a Google Drive download. The execution flow typically follows:

  • Email opened via Outlook
  • Link clicked, launching Chrome
  • Malicious JAR downloaded
  • Execution via javaw.exe

This multi-step process highlights how attackers exploit user trust and common enterprise tools to deliver payloads .

Complete Attack Chain, Source : Acronis

Advanced Evasion Techniques

1. Obfuscation

The malware uses tools like Stringer and Allatori to obfuscate Java bytecode, making reverse engineering significantly harder.

2. Polymorphism

A notable feature is the FilePumper class, which modifies the malware’s own JAR file by adding random data. This ensures every instance has a unique hash, effectively bypassing signature-based detection systems.

Flexible Configuration and C2 Communication

The malware loads hardcoded configurations that define:

  • Command-and-control (C2) servers
  • Communication ports
  • TOR routing paths
  • Persistence mechanisms

A key parameter, PASSWORD, acts as both an authentication token and a decryption key for additional payloads. This dual-purpose design allows secure communication and modular expansion of functionality.

Raw telemetry data, Source : Acronis

Geofencing: A Strategic Targeting Mechanism

One of the most distinctive features is its strict geofencing logic:

  • Checks system language and locale (must be Turkish)
  • Verifies IP-based geolocation (must resolve to Turkey)

This ensures the malware executes only in intended regions, reducing exposure to global security researchers and sandbox environments .

Payload Execution and File Encryption

Once activated, the malware performs several preparatory actions:

  • Disables Microsoft Defender
  • Deletes Volume Shadow Copies
  • Suppresses security notifications
  • Disables Windows Update

It then downloads a ransomware module that:

  • Encrypts files using AES
  • Communicates via Tor
  • Can exfiltrate or delete files

After encryption, ransom notes are dropped with filenames like _ONEMLI_NOT_XXXX.TXT, translating to “Important Note” in Turkish.

Why JanaWare Stands Out

Unlike large-scale ransomware campaigns, JanaWare is:

  • Region-specific (Turkey-focused)
  • Low-profile but persistent
  • Modular and selectively deployed

This makes it harder to detect and less likely to trigger global cybersecurity alerts.

Our Opinion on the JanaWare Campaign

JanaWare represents a shift in ransomware strategy—from broad, noisy attacks to highly targeted and stealthy operations. By focusing on a specific geographic region, the attackers significantly reduce their exposure to international cybersecurity scrutiny. This is a smart operational decision, as most automated analysis systems and threat researchers are located outside the targeted region.

The use of Adwind RAT as a delivery mechanism also reflects a modular mindset. Instead of deploying ransomware immediately, attackers first establish control and then decide whether to escalate. This selective deployment increases success rates and minimizes wasted effort.

Another concerning aspect is the combination of polymorphism and obfuscation. Traditional security tools relying on hash-based detection are ineffective against such techniques. This highlights the growing need for behavior-based detection systems like EDR and XDR.

However, the campaign’s reliance on phishing indicates that human error remains the weakest link. Even the most advanced malware still depends on user interaction to gain initial access.

In our view, JanaWare is not just a technical threat—it’s a strategic one. It demonstrates how cybercriminals are becoming more disciplined, targeted, and efficient. Organizations must respond with equally adaptive defenses, focusing on user awareness, endpoint monitoring, and threat intelligence.

CyberDefender