Turkey-focused low-dollar ransomware campaign using phishing and modified commercial malware
Campaign
Summary
Hide ▲
Show ▼
A Turkey-focused ransomware campaign has been hitting individuals and SMBs with low-dollar extortion at scale, making the operation significant despite the modest ransom demands. The initial access path uses phishing, a cloud-hosted file, and a malicious Java archive, while the payload chain includes Adwind RAT and the JanaWare ransomware plug-in.
Related Happenings
Storm-1175 high-tempo Medusa ransomware campaign
Campaign
First: 07.04.2026 13:02
Last: 07.04.2026 13:02
Sources 1
About this happening:
**Storm-1175** is running a **high-tempo Medusa ransomware campaign** that has repeatedly exploited **n-day and zero-day flaws** to gain initial access before patching closes the...
Storm-1175 high-tempo Medusa ransomware campaign
CampaignAbout this happening: **Storm-1175** is running a **high-tempo Medusa ransomware campaign** that has repeatedly exploited **n-day and zero-day flaws** to gain initial access before patching closes the...
Storm-1175 high-velocity zero-day and N-day intrusion campaign
Campaign
First: 07.04.2026 09:35
Last: 07.04.2026 09:35
Sources 1
About this happening:
**Storm-1175** is running a **high-velocity intrusion campaign** that chains **zero-day** and **N-day vulnerabilities** to gain initial access to exposed systems, raising the risk...
Storm-1175 high-velocity zero-day and N-day intrusion campaign
CampaignAbout this happening: **Storm-1175** is running a **high-velocity intrusion campaign** that chains **zero-day** and **N-day vulnerabilities** to gain initial access to exposed systems, raising the risk...
FAUX#ELEVATE phishing campaign targeting French-speaking corporate environments
Campaign
First: 24.03.2026 18:35
Last: 24.03.2026 18:35
Sources 1
About this happening:
The **FAUX#ELEVATE** phishing campaign is actively targeting **French-speaking corporate environments** with **fake resume/CV lures** that deliver malware for **credential theft**...
FAUX#ELEVATE phishing campaign targeting French-speaking corporate environments
CampaignAbout this happening: The **FAUX#ELEVATE** phishing campaign is actively targeting **French-speaking corporate environments** with **fake resume/CV lures** that deliver malware for **credential theft**...
OAuth URL redirection phishing campaign targeting government and public-sector organizations
Campaign
First: 03.03.2026 11:20
Last: 03.03.2026 11:20
Sources 1
About this happening:
The **OAuth URL redirection** phishing campaign is targeting **government and public-sector organizations**, using attacker-controlled redirects to bypass normal **email** and **b...
OAuth URL redirection phishing campaign targeting government and public-sector organizations
CampaignAbout this happening: The **OAuth URL redirection** phishing campaign is targeting **government and public-sector organizations**, using attacker-controlled redirects to bypass normal **email** and **b...
Amnesia RAT retrieved from Dropbox for data theft and remote control
Malware Activity
First: 24.01.2026 13:09
Last: 24.01.2026 13:09
Sources 1
About this happening:
The **Amnesia RAT** payload is being staged from **Dropbox**, giving the operators a **remote-access trojan** that can steal data and control infected endpoints. It is the final s...
Amnesia RAT retrieved from Dropbox for data theft and remote control
Malware ActivityAbout this happening: The **Amnesia RAT** payload is being staged from **Dropbox**, giving the operators a **remote-access trojan** that can steal data and control infected endpoints. It is the final s...
Timeline
-
16.04.2026 09:00 2 articles · 1mo ago
Acronis documents Turkey-focused JanaWare ransomware campaign
Technical Analysis UpdateAcronis documented a Turkey-focused, low-dollar ransomware campaign that has been active since at least 2020, using phishing emails that lead to a cloud-hosted file and a malicious Java archive to deliver a custom Adwind RAT variant. The malware establishes persistence, checks for victims in Turkey with Turkish-language systems, disables Microsoft Defender and other defenses, and deploys the JanaWare ransomware plug-in with ransom demands of $200 to $400 against individuals and SMBs.
Show sources
- 6-Year Ransomware Campaign Targets Turkish Homes & SMBs — www.darkreading.com — 16.04.2026 09:00
- 6-Year Ransomware Campaign Targets Turkish Homes & SMBs — www.darkreading.com — 16.04.2026 09:00