{
  "family": "jottix",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Jottix (classified across cybersecurity organizations as Ransom:Win32/Jottix, Trojan-Ransom.Win32.Jottix, and Win32/Jottix) is a targeted crypto-ransomware family engineered to execute rapid and irreversible file encryption across Windows endpoints and connected enterprise storage. Propagated through spear-phishing campaigns with malicious macro attachments, trojanized installers, and compromised Remote Desktop Protocol (RDP) sessions, Jottix initiates execution by assessing local user privileges. It targets user documents, spreadsheets, databases, financial ledgers, and virtual disk images across local hard drives, USB external storage, and mapped SMB network shares. Jottix utilizes symmetric AES-256 encryption in conjunction with an embedded RSA public master key, appending a unique .jottix extension to locked files. It drops ransom notes titled HOW_TO_RECOVER_FILES_JOTTIX.txt instructing victims to establish contact via encrypted communication channels. To obstruct local data restoration, Jottix executes shell commands to delete Volume Shadow Copies and disable Windows Startup Recovery.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Jottix",
    "Trojan-Ransom.Win32.Jottix",
    "Win32/Jottix",
    "Jottix Ransomware",
    "Ransom.Jottix"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Jottix?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jottix is a crypto-ransomware family that encrypts files across Windows endpoints and network shares using AES-256 and RSA."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jottix target enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates mapped network drives and SMB shares, recursively encrypting shared files across the local corporate subnet."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jottix prevent file recovery via Windows features?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to purge Volume Shadow Copies and uses bcdedit to disable automatic recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "What vector is commonly used to distribute Jottix?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spear-phishing emails with malicious attachments, RDP credential brute-forcing, and multi-stage trojan loaders."
      }
    },
    {
      "@type": "Question",
      "name": "What steps should be taken upon detecting a Jottix infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately isolate affected systems from the network, preserve ransom notes and memory dumps, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Jottix from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Jottix persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Jottix attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Jottix modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Jottix dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Jottix",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Jottix"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Jottix Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.jottix"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}