Trusted Design

ZEDSEC - JAFF Ransomware IOC

概要

A massive malicious email campaign that stems from the Necurs botnet is spreading a new ransomware at the rate of 5 million emails per hour and hitting computers across the globe. Dubbed Jaff, the new file-encrypting ransomware is very similar to the infamous Locky ransomware in many ways, but it is demanding 1.79 Bitcoins (approx $3,150), which much higher than Locky, to unlock the encrypted files on an infected computer. According to security researchers at Forcepoint Security Lab, Jaff ransomware, written in C programming language, is being distributed with the help of Necurs botnet that currently controls over 6 million infected computers worldwide. Necurs botnet is sending emails to millions of users with an attached PDF document, which if clicked, opens up an embedded Word document with a malicious macro script to downloads and execute the Jaff ransomware.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Jaff Ransomware and Suspicious PDF Delivery (score: 0.80)
• Necurs Botnet Fuels Massive Spam Campaigns Spreading Jaff Ransomware (score: 0.80)
• Jaff Ransomware Gets Makeover - SANS Internet Storm Center (score: 0.78)
• Player 1 Limps Back Into the Ring - Hello again, Locky! (score: 0.72)
• Locky: New Ransomware Mimics Dridex-Style Distribution (score: 0.66)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る