Loading malware…
Adwind is a Java-based remote access trojan (RAT), also referred to in the provided content by aliases including AlienSpy, Frutas, jBiFrost, jFrutas, jRAT, jSocket, Sockrat, Trojan.Maljava, and Unrecom. The content specifically associates jRAT behaviors with Adwind and describes it as a cross-campaign RAT used for remote access, reconnaissance, credential theft, and follow-on payload delivery.
Capabilities directly mentioned in the content include mapping UPnP ports; enumerating installed security software and firewall details via WMIC/WMI; capturing clipboard data; capturing video from a webcam; supporting RDP control; stealing passwords from common web browsers including Internet Explorer, Google Chrome, and Firefox; and stealing passwords from chat applications including MSN Messenger, AOL Instant Messenger, and Google Talk. The content also notes distribution as HTA files with JScript.
Adwind has been observed in multiple criminal contexts. Proofpoint linked infrastructure associated with TA2722/Balikbayan Foxes to a registration email, anthony.marshall.1986@gmail[.]com, that had previously been associated with Adwind RAT campaigns reported in 2017. Separately, Unit 42 listed Adwind among the top RAT families used in Nigerian BEC scams.
The most detailed recent reporting in the content concerns a customized Adwind variant used by an Acronis-tracked threat cluster to deliver the JanaWare ransomware family. In that campaign, phishing emails delivered malicious Java archive files, including cases where Outlook launched Chrome to open a Google Drive link that downloaded a malicious JAR executed via javaw.exe. The customized Adwind variant was heavily obfuscated using Stringer and Allatori, used custom class loaders, and included a FilePumper component that modified its own JAR by adding random content, producing polymorphic samples with different hashes. The malware embedded hard-coded configuration including a C2 domain, TCP ports, Tor-related paths, a version identifier, startup/persistence settings, and a static PASSWORD value used both for initial authentication and payload decryption.
In the JanaWare activity, Adwind acted as a multi-stage loader and enforced geofencing based on Turkish language, locale, country settings, and external IP geolocation, proceeding only when the environment matched Turkey. After those checks, it executed PowerShell and registry commands to weaken defenses, including attempts to disable or weaken Microsoft Defender, suppress security notifications, remove Volume Shadow Copy recovery mechanisms, hide ransomware protection features, enumerate installed antivirus products, and interfere with endpoint protection integrations. It then downloaded a Java ransomware plugin that communicated over Tor, encrypted files across available drives using AES, and dropped Turkish-language ransom notes with partially randomized filenames containing the fixed prefix ONEMLI_NOT. Victimology in that campaign was described as primarily Turkish home users and small to medium-sized businesses, with observed ransom demands of roughly $200 to $400. The content identifies sample hash 4f0444e11633a331eddb0deeec17fd69 as Adwind RAT and infrastructure at elementsplugin.duckdns.org resolving to 151.243.109.115 on ports 49152 and 49153.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In some cases, the infrastructure used is the same as the one we saw when analyzing the Adwind Trojan.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The top 10 of the RATs used in Nigerian BEC scams is formed by NetWire, DarkComet, NanoCore, LuminosityLink, Remcos, ImminentMonitor, NJRat, Quasar, Adwind, and Hworm.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack begins with phishing emails that trick users into clicking malicious links.
After the victim opens the initial malicious attachment, the Adwind loader uses obfuscated scripts and multi-stage deployment to avoid easy detection by antivirus tools, unpacking the RAT into memory and establishing persistence through registry entries, scheduled tasks, or user-level startup entries.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
...establishing persistence through registry entries, scheduled tasks, or user-level startup entries.
After the victim opens the initial malicious attachment, the Adwind loader uses obfuscated scripts and multi-stage deployment to avoid easy detection by antivirus tools...
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
AppleSeed has the ability to use JavaScript to execute PowerShell. APT32 has used JavaScript for drive-by downloads and C2 communications. Astaroth uses JavaScript to perform its core functionalities.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
The malware modifies its own JAR file using a component called “FilePumper,” inserting random data to generate unique file hashes for each infection.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
Throughout this stage, both the RAT and the ransomware use simple but effective detection-evasion tactics such as common process names, basic anti-analysis checks, and environment awareness to limit their exposure to automated analysis systems.
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine. Agent Tesla has the ability to extract credentials from configuration or support files. APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
Throughout this stage, both the RAT and the ransomware use simple but effective detection-evasion tactics such as common process names, basic anti-analysis checks, and environment awareness to limit their exposure to automated analysis systems.
The malware enforces strict geofencing controls by checking system language, locale settings, and external IP addresses. Execution proceeds only if the system matches Turkish regional indicators.
71 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Java-based remote access trojan repurposed in this campaign as a multi-stage loader delivering JanaWare, with added modules and post-exploitation scripts.
A customized Java-based remote access trojan used as the initial payload in the JanaWare campaign. It is delivered via phishing and malicious JAR files, establishes a foothold, uses obfuscation and polymorphism, and deploys the ransomware module after confirming the victim is in Turkey.
Adwind is used as the initial malware in the attack chain, helping launch JanaWare infections while using obfuscation to evade detection.
A customized cross-platform remote access trojan used to gain initial access, establish persistence, profile victims, communicate with C2, and selectively download and execute the JanaWare ransomware payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.