{"id":25301,"date":"2021-05-30T20:06:55","date_gmt":"2021-05-30T17:06:55","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=25301"},"modified":"2026-03-27T22:32:01","modified_gmt":"2026-03-27T19:32:01","slug":"from-mass-scale-campaigns-to-big-game-hunting-how-jsworm-ransomware-reinvented-itself-in-just-two-years","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/from-mass-scale-campaigns-to-big-game-hunting-how-jsworm-ransomware-reinvented-itself-in-just-two-years\/","title":{"rendered":"From mass-scale campaigns to big game hunting: how JSWorm ransomware reinvented itself in just two years"},"content":{"rendered":"\n

As targeted ransomware continues to haunt businesses all over the globe, one can\u2019t help but look deeper into the operations of particular ransomware gangs. This helps to better understand them and develop more advanced protection against the threats they pose. Kaspersky researchers took apart and inspected a curious specimen (or, more correctly, specimens) belonging to the JSWorm group, which demonstrated its agility when it comes to upgrading its toolset. The group, which has previously focused on mass-scale operations, was able to quickly adapt and evolve into a highly-targeted operation in just two years, developing over eight distinct malware \u2018brand names\u2019.<\/strong><\/p>\n\n\n\n

Each \u2018rebranded\u2019 variant had different aspects of the code, renamed file extensions, cryptographic schemes and encryption keys altered. Together with name changes, the developers of this ransomware have also been reworking their code and trying different approaches to distribution, which shows they are highly adaptivity and have vast resources at hand.<\/p>\n\n\n\n

\"E30\"<\/a><\/figure>\n\n\n\n

The most notable versions of ransomware created by the JSWorm developers<\/em><\/p>\n\n\n\n

JSWorm has been detected across the globe \u2013 from North and South America (Brazil, Argentina, USA) to the Middle East and Africa (South Africa, Turkey, Iran), Europe (Italy, France, Germany), and APAC (Vietnam), with more than a third (39%) of of all the enterprises and individuals this group targeted in 2020 located in APAC.<\/em><\/em><\/p>\n\n\n\n

When it comes to target industries, it is clear that this ransomware family eyes critical infrastructure and major sectors across the world. Nearly half (41%) of JSWorm attacks were targeted against companies in the Engineering and Manufacturing industry. Energy and Utilities (10%), Finance (10%), Professional and Consumer Services (10%), Transportation (7%), and Healthcare (7%) were also at the top of their list.<\/p>\n\n\n\n

\u201cJSWorm\u2019s operations, and its ability to adapt and develop new malware so quickly, reflects an important and worrying trend \u2013 ransomware gangs have more than enough resources at their disposal to change their operations and upgrade their toolsets at a disturbing speed, tackling more and more organizations across the world. Such high adaptiveness is usually seen among APT groups, but ransomware gangs are not limited to specific targets, they will happily go after any company they would be able to infect. This demonstrates that to protect one\u2019s organization, cybersecurity teams need to become even faster, more attentive and adaptive when it comes to installing security measures,\u201d <\/em>comments Fedor Sinitsyn, <\/em>security researcher at Kaspersky.<\/p>\n\n\n\n

Read the full report about the different versions of JSWorm on\u00a0Securelist<\/a>. Learn more about the ransomware ecosystem in the\u00a0Ransomware world in 2021: who, how and why<\/em><\/a>\u00a0<\/em>report.<\/p>\n\n\n\n

To remain protected against JSWorm and other types of ransomware, Kaspersky recommends:<\/p>\n\n\n\n