Jaff Ransomware: Player 2 Has Entered The Game
Summary: Cisco Talos tracked two large email campaigns distributing a new ransomware variant called Jaff, beginning May 11, 2017 at 0800 UTC with roughly 35,768 messages and continuing May 12 at 0900 UTC with approximately 72,798 emails, for over 100,000 total. Each email carried a PDF with an embedded Word document that ran a VBA macro to download the payload, which encrypted files with a .jaff extension and demanded 2.01117430 Bitcoin, about $3,700 at the time.
Key Takeaway: The ransom was set well above what other ransomware families were asking, and Talos noted the Bitcoin wallet tied to the payment server had zero transactions - the price point that deters payment versus maximizes profit was still an open question. The campaigns spread through Necurs, the same spam infrastructure previously used for Locky and Dridex, which let a new actor reach six-figure email volumes within two days.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026