JanaWare Ransomware Targets Turkey via Adwind RAT

SOC Prime Team

JanaWare Ransomware Targets Turkey via Adwind RAT

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A threat cluster is using a customized variant of the Java-based Adwind RAT to deploy a ransomware payload known as JanaWare. The activity is primarily aimed at users in Turkey, with the malware performing locale and IP-based checks before continuing execution. Researchers have tracked related samples since 2020, while more recent command-and-control activity indicates the campaign remained active in 2025.

Investigation

The Acronis TRU team examined malicious JAR files distributed through phishing emails that were launched through Outlook and Chrome. Once executed, the infection chain moved to javaw.exe, which loaded the tailored Adwind RAT strain and later deployed the JanaWare ransomware component. Analysis also showed the use of polymorphic JAR files, Tor-based command-and-control infrastructure, and a ransom note written in Turkish.

Mitigation

Defenders should block the malicious domain elementsplugin.duckdns.org and any associated ports, while restricting the execution of unsigned Java JAR files across the environment. Security teams should also watch for suspicious chrome.exe command lines tied to downloads from Google Drive and strengthen email protections against phishing delivery. Endpoint defenses should be tuned to identify Adwind RAT behavior as well as suspicious file-encryption activity linked to ransomware execution.

Response

If infection is suspected, isolate affected systems immediately, terminate javaw.exe and any related malicious processes, and capture volatile evidence before shutdown or cleanup. Recovery efforts should prioritize restoring files from verified clean backups. Incident response teams should also gather available command-and-control telemetry and evaluate whether law enforcement notification is appropriate in cases involving ransom demands or extortion.

"graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccccff classDef operator fill:#ff9900 %% Nodes action_phishing["Action – T1566 Phishing: Send phishing email with malicious Google Drive link"] class action_phishing action tool_malicious_link["Tool – Name: Malicious Google Drive link"] class tool_malicious_link tool action_user_exec["Action – T1204.001 User Execution: Victim clicks link; Chrome downloads malicious JAR"] class action_user_exec action process_chrome["Process – Chrome browser"] class process_chrome process malware_obf_jar["Malware – Obfuscated JAR (Allatori/Stringer)"] class malware_obf_jar malware process_javaw["Process – javaw.exe (JamPlus)"] class process_javaw process action_obfuscation["Action – T1027 Obfuscated Files or Information: Uses polymorphic code, junk insertion, dynamic API resolution"] class action_obfuscation action action_persistence["Action – T1547.014 Active Setup: Writes registry entry for autou2011start"] class action_persistence action action_impair_defense["Action – T1562 Impair Defenses: Disables Microsoft Defender, Windows Update, VSS via PowerShell and registry"] class action_impair_defense action process_powershell["Process – PowerShell"] class process_powershell process action_recovery_inhibit["Action – T1490 Inhibit System Recovery and T1070.004 File Deletion: Removes shadow copies and deletes files"] class action_recovery_inhibit action action_encrypt["Action – T1486 Data Encrypted for Impact: Downloads ransomware module, encrypts files with AES, drops Turkish ransom note"] class action_encrypt action malware_ransomware["Malware – Ransomware module"] class malware_ransomware malware action_c2_obfusc["Action – T1001 Data Obfuscation and T1102.003 Web Service: Oneu2011Way Communication: Uses Tor for C2 traffic"] class action_c2_obfusc action tool_tor["Tool – Tor network"] class tool_tor tool action_exfil["Action – T1041 Exfiltration Over C2 Channel and T1020 Automated Exfiltration: Sends selected files through Tor channel"] class action_exfil action %% Connections action_phishing –>|delivers| tool_malicious_link tool_malicious_link –>|opened by victim leads to| action_user_exec action_user_exec –>|downloads via| process_chrome process_chrome –>|saves and launches| malware_obf_jar malware_obf_jar –>|executed by| process_javaw process_javaw –>|performs| action_obfuscation process_javaw –>|establishes| action_persistence action_persistence –>|writes registry for| action_impair_defense action_impair_defense –>|uses| process_powershell action_impair_defense –>|enables| action_recovery_inhibit action_recovery_inhibit –>|precedes| action_encrypt action_encrypt –>|loads| malware_ransomware malware_ransomware –>|communicates via| action_c2_obfusc action_c2_obfusc –>|routes through| tool_tor tool_tor –>|enables| action_exfil malware_ransomware –>|exfiltrates data| action_exfil "

Attack Flow

Attack Narrative & Commands:
An attacker who has gained low‑privilege user access wishes to disable Windows Defender to pave the way for ransomware deployment. Leveraging the signed powershell.exe binary (T1218.001), the attacker runs a one‑liner that disables real‑time monitoring and disables cloud‑based protection, thereby weakening the endpoint’s defensive posture.
```
# Disable real‑time monitoring and cloud‑based protection
Set-MpPreference -DisableRealtimeMonitoring $true -MAPSReporting Disable
```
The command line contains the Set-MpPreference keyword, which matches the detection rule’s selection criteria.

Regression Test Script: The following self‑contained PowerShell script reproduces the attack and ensures the telemetry is generated.

# ==============================
# Simulation: Disable Microsoft Defender
# ==============================
try {
    Write-Host "[*] Disabling real‑time monitoring..."
    Set-MpPreference -DisableRealtimeMonitoring $true -MAPSReporting Disable
    Write-Host "[+] Defender disabled."
} catch {
    Write-Error "Failed to modify Defender preferences: $_"
}

Cleanup Commands: Restore the original Defender configuration to avoid leaving the endpoint exposed.

# Re‑enable real‑time monitoring and cloud protection
Set-MpPreference -DisableRealtimeMonitoring $false -MAPSReporting Advanced
Write-Host "[*] Defender restored to default state."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free