Loading malware…
J-Ransom is a ransomware strain associated in reporting with the broader “J” group, which is described as being better understood through victimology and sometimes functioning more as a leak-site identity than as a stable malware family. Older sources describe J-Ransom, and separate vendor reporting mentions samples captured in April 2025. High-confidence reporting in the provided content identifies the strain as using the encrypted file extension ".LoveYou." One publicly indexed sample is associated with MD5 4924B945CFDC5BFECE03F5140A546384. Beyond that extension and sample reference, the available content does not provide confirmed technical details on execution flow, infection vector, platform targeting, or specific victim industries for J-Ransom.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Poorly documented ransomware strain label/brand with limited consistent public technical detail; reported extension .LoveYou in some strain reporting.
Ransomware strain label with inconsistent public attribution/actor stability; reported extension ".LoveYou" and at least one publicly indexed sample hash.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.