{
  "family": "jaiks",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Jaiks (classified in antimalware threat repositories as Ransom:Win32/Jaiks and Trojan-Ransom.Win32.Jaiks) is an evasive crypto-ransomware family designed to execute high-speed file encryption across Windows enterprise workstations and file servers. Distributed through targeted phishing attacks and exposed RDP brute-force intrusions, Jaiks terminates local database services (including Microsoft SQL Server and MySQL) and backup software to unlock protected files. Utilizing AES-256 encryption with an embedded RSA public key, Jaiks encrypts documents, source code, and virtual disks, appending .jaiks to filenames. It drops ransom notes titled JAIKS_README_DECRYPT.txt detailing cryptocurrency ransom demands and wipes Volume Shadow Copies using administrative command-line utilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Jaiks",
    "Trojan-Ransom.Win32.Jaiks",
    "Win32/Jaiks",
    "Jaiks Ransomware",
    "Ransom.Jaiks"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Jaiks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jaiks is an enterprise crypto-ransomware family that encrypts Windows files and servers using AES-256 and RSA."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Jaiks terminate database services before encrypting?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminating database processes releases file locks, allowing Jaiks to encrypt live database stores without error."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jaiks eliminate Windows recovery points?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and configures bcdedit to disable automatic Windows repair."
      }
    },
    {
      "@type": "Question",
      "name": "Does Jaiks encrypt files on mapped network drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it traverses mapped network drives and SMB shares to encrypt centralized enterprise storage."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended incident response procedure for Jaiks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect infected machines from the network, isolate impacted file servers, and restore clean data from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Jaiks from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Jaiks persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Jaiks attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Jaiks modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Jaiks dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Jaiks",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Jaiks"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}