{
  "family": "jigsaw",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Jigsaw (classified across cybersecurity organizations as Ransom:Win32/Jigsaw, Trojan-Ransom.Win32.Jigsaw, and BitcoinBlackmailer) is a notorious and psychologically manipulative crypto-ransomware family first discovered in March 2016. Developed using the Microsoft .NET framework, Jigsaw is infamous for displaying the iconic face of 'Billy the Puppet' from the 'Saw' horror franchise alongside a ticking countdown clock. Unlike standard ransomware that merely encrypts files and passively awaits payment, Jigsaw employs an active extortion tactic: it systematically deletes an increasing quantity of encrypted files every 60 minutes that ransom payment in Bitcoin is delayed. If the victim terminates the malware process, reboots the computer, or attempts to modify the ransomware binary, Jigsaw punishes the user by deleting 1,000 files immediately upon system restart. Jigsaw encrypts files using AES-128 encryption, appending extensions such as `.fun`, `.gws`, `.kkk`, or `.btc`, and sets up persistent autostart entries under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` to ensure the deletion countdown resumes upon every boot.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Jigsaw",
    "Trojan-Ransom.Win32.Jigsaw",
    "Win32/Jigsaw",
    "BitcoinBlackmailer",
    "Jigsaw Ransomware",
    "Saw Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Jigsaw?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jigsaw is a .NET ransomware family that deletes a batch of encrypted files every hour until the ransom is paid."
      }
    },
    {
      "@type": "Question",
      "name": "What happens if a victim restarts their PC while infected with Jigsaw?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jigsaw penalizes the user by instantly deleting 1,000 encrypted files upon reboot as punishment for restarting."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption algorithm does Jigsaw use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jigsaw uses the AES-128 algorithm with static or recoverable key derivation routines in its .NET binary."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by Jigsaw ransomware be decrypted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. Cybersecurity researchers reverse-engineered Jigsaw's .NET key generator and released free decryption tools."
      }
    },
    {
      "@type": "Question",
      "name": "How should an active Jigsaw infection be neutralized safely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate firefox.exe and drpbx.exe (disguised Jigsaw processes) via Task Manager without rebooting, disable its Run key, and run a decryptor."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1485",
    "T1491",
    "T1547.001",
    "T1083",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "CRITICAL: Do NOT turn off, restart, or attempt to terminate the ransomware process using Task Manager. This will trigger the punitive deletion of 1,000 files.",
    "Use a specialized tool (like Process Explorer run from a USB drive) to specifically suspend the active Jigsaw threads in memory before attempting termination.",
    "Once the process is safely suspended/terminated, locate and remove the autostart entries in the Registry and Startup folder.",
    "Do NOT pay the ransom. Decryption tools for older Jigsaw variants are freely available from projects like No More Ransom."
  ],
  "what_to_avoid": [
    "Do not panic and abruptly restart the computer; this is exactly what the malware is waiting for to delete bulk data.",
    "Avoid paying the ransom; due to flaws in Jigsaw's early implementations, the decryption keys are often hardcoded or extractable from memory."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Jigsaw",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Jigsaw"
    },
    {
      "name": "Trend Micro Security Intelligence - Jigsaw Ransomware Technical Breakdown",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_jigsaw"
    },
    {
      "name": "MITRE ATT&CK - Data Destruction (T1485)",
      "url": "https://attack.mitre.org/techniques/T1485/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}