Loading story…
Acronis reported that the JanaWare ransomware operation has targeted individuals and businesses in Turkey since 2020, using a highly localized infection chain designed to run only on Turkish systems. The malware checks system locale, language settings, and external IP geolocation before executing, while ransom notes written in Turkish instruct victims to contact the attackers through qTox. Researchers said the campaign primarily affects home users and small to medium-sized businesses, with ransom demands typically ranging from $200 to $400.
The attacks are mainly delivered through phishing emails carrying malicious Java archive files, with some lures sent via Outlook messages containing Google Drive links, and often begin with the Adwind malware loader using obfuscation to evade detection. Researchers described JanaWare as a low-value, high-volume extortion scheme whose narrow geographic focus may have helped it avoid wider scrutiny, while also reflecting a broader ransomware market that is fragmenting into more specialized variants.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In April 2026, Acronis publicly reported that JanaWare was being distributed mainly through phishing emails carrying malicious Java archive files, often involving the Adwind malware loader. The company said the campaign primarily affected home users and small to medium-sized businesses and typically demanded $200 to $400 in ransom.
Acronis reported that the JanaWare ransomware campaign has targeted individuals and businesses in Turkey since 2020. The operation appears highly localized, using Turkish-language ransom notes, qTox contact details, and execution checks based on system locale and IP geolocation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcegbhackers.com
Open sourcescworld.com
Open sourcecyberpress.org
Open sourcetherecord.media
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported two active malware operations linked to Turkish-origin threat actors, including a campaign exploiting **`CVE-2025-8088`** in WinRAR and a separate multi-stage **XWorm V6.0** distribution chain. In the WinRAR case, victims in Turkey and Germany were lured with a malicious archive named **`fiyat teklifi.rar`**, which abused NTFS Alternate Data Streams and path traversal to drop a .NET downloader into the Windows Startup folder. That downloader fetched a second-stage payload from **`34[.]69[.]246[.]76`**, ultimately installing a PyInstaller-packed Telegram RAT, **`WindowsServices.exe`** version 1.0.8, capable of keylogging, webcam and screen capture, browser theft, FTP exfiltration, remote shell access, and UAC bypass. Investigators said the infrastructure remained live, including HTTP payload hosting, FTP services, leader-election APIs, and the Telegram bot **`@Roberta3358_bot`**, and identified at least one active victim in Istanbul. A separate Breakglass report described an ongoing **XWorm V6.0** campaign attributed with high confidence to a Turkish-origin actor using the GitHub alias **`flexhere687-art`** and the exposed email **`flexhere687@gmail[.]com`**. That operation used Google Blogger, Filemail, and GitHub to deliver obfuscated JavaScript droppers, BAT files with UAC bypass, and a trojanized Python 3.12 package that decrypted shellcode in memory, while lures referenced taxes, invoices, shipping, banking, and CVs. The malware chain established persistence through Run keys, Startup folder placement, scheduled tasks, and LOLBin abuse via **`SyncAppvPublishingServer.vbs`**, and included BAT scripts that broadly weakened Microsoft Defender through exclusions. Both reports highlighted weak operator security, including Turkish-language artifacts, exposed infrastructure, embedded credentials, plaintext HTTP, and still-accessible domains and repositories, indicating the campaigns were active and operational at the time of analysis.
Jul 12, 2026
NetWalker, also tracked as **Mailto** and **Koko**, emerged in 2019 as a ransomware family that increasingly targeted enterprise networks and later matured into a **ransomware-as-a-service (RaaS)** operation. Early campaigns used spam lures, including COVID-19-themed emails carrying a Visual Basic Script dropper, while other intrusions were linked to exposed **RDP**, vulnerable **Pulse Secure VPN** (`CVE-2019-11510`), **Telerik UI** (`CVE-2019-18935`), Oracle WebLogic, and Apache Tomcat. The malware encrypted Windows systems, deleted shadow copies, appended victim-specific extensions such as `.mailto[{mail1}].{id}`, and dropped ransom notes like `{ID}-Readme.txt`; over time, operators shifted from email-based negotiations to **Tor** payment portals and leak sites.
Aug 15, 2026
Cybercriminals have been sending phishing emails that impersonate **Interpol** and other international law-enforcement bodies to trick recipients into installing ransomware. The messages, framed as notices from an alleged “Cybercrime Investigation Unit,” accuse targets of suspicious or fraudulent activity and pressure them to review supposed evidence. Reports indicate the campaign has targeted small businesses across **Europe, Asia, the Middle East, and North America**, using fear and urgency to drive victims to open attacker-controlled files. The emails direct recipients to a password-protected archive hosted on **Proton Drive**, where the lure file is presented as evidence but ultimately leads to an executable disguised as a video. Once launched, the malware encrypts systems and drops a ransom note instructing victims to contact the operators via **Tox** rather than pay a fixed amount, indicating case-by-case extortion. Researchers said the payload appears to be a **simple custom-built ransomware strain** that does not match known families and relies on hardcoded values instead of more advanced infrastructure.
Aug 11, 2026