JanaWare Ransomware: Turkish Citizens in the Crosshairs

The cybercriminal landscape is a constantly shifting beast, and new ransomware strains are always emerging. According to The Record by Recorded Future, a new player dubbed ‘JanaWare’ has been actively targeting Turkish citizens since at least 2020. This isn’t some fly-by-night operation; The Record by Recorded Future indicates a sustained campaign.

What makes JanaWare particularly nasty is its reliance on execution constraints. The malware checks both the system locale and external IP geolocation, meaning it’s specifically designed to activate only when it detects a Turkish system. This geo-fencing tactic is a clear indicator of a focused campaign, suggesting the threat actors behind JanaWare have a specific victim demographic in mind.