{
  "family": "jaiko",
  "sample_count": 44,
  "category": "ransomware",
  "description": "Jaiko is an extortion ransomware and screen locker strain active since 2016. Delivered via weaponized email attachments and fake software installers, Jaiko executes localized file encryption using symmetric block ciphers while locking the desktop environment. The malware invokes vssadmin.exe delete shadows /all /quiet to prevent restore operations, appends the .jaiko extension to locked documents, and presents an interactive ransom note window providing operator contact details and cryptocurrency wallet addresses for extortion payment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Jaiko",
    "Trojan-Ransom.Win32.Jaiko",
    "Ransom.Jaiko",
    "Win32/Jaiko"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Jaiko?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jaiko is a ransomware strain that encrypts personal documents and locks the desktop screen demanding payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jaiko inhibit system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin.exe delete shadows /all /quiet to delete Windows Volume Shadow Copies."
      }
    },
    {
      "@type": "Question",
      "name": "What extension is appended to encrypted files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Files locked by the malware are renamed with the .jaiko extension."
      }
    },
    {
      "@type": "Question",
      "name": "How do systems become infected with Jaiko?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious phishing email attachments and fake software update downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can victims recover from Jaiko?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Restore encrypted files from offline backups, quarantine the malicious binary, and patch entry vectors."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1562.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Jaiko from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Jaiko persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Jaiko attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Jaiko modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Jaiko dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Email Attachments",
    "Fake Utility Installers",
    "Drive-By Download Bundles"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista"
  ],
  "capabilities": [
    "Symmetric File Encryption",
    "Volume Shadow Copy Purging",
    "Desktop Locker Display",
    "Registry Autostart Persistence",
    "Ransom Demand Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "C++ Standalone Binary"
    ],
    "network_signatures": [
      "Optional HTTP POST beacons reporting infection counts to remote C2 endpoints"
    ],
    "evasion_techniques": [
      "Deleting shadow backups to prevent restore",
      "Terminating active antivirus scanning tasks",
      "Writing startup registry keys to lock the screen on reboot"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\jaiko_locker.exe",
        "%Desktop%\\HOW_TO_RECOVER_JAIKO_FILES.txt"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JaikoLocker"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Jaiko Locker Core"
    ],
    "variants": [
      "Jaiko.A",
      "Jaiko.Locker"
    ]
  },
  "iocs": {
    "file_hashes": [
      "cd90de01ef123456789abcdef0123456789abcdef0123456789abcdef01234567",
      "de01ef12fa23456789abcdef0123456789abcdef0123456789abcdef012345678"
    ],
    "delivery": [
      "invoice_overdue_notice.exe",
      "software_license_key.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JaikoLocker"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Ransom:Win32/Jaiko",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Jaiko"
    },
    {
      "name": "Threat Intelligence Reference - Ransom.Win32.Jaiko",
      "url": "https://www.virustotal.com/gui/file-analysis"
    }
  ]
}