Jigsaw (ransomware)

Encrypting ransomware created in 2016

Jigsaw

Technical name| BitcoinBlackmailer
Classification| Ransomware
Isolation| 2016
Operating system(s) affected| Windows
Filesize| 284 KB
Written in| VB.net

Jigsaw is a form of encrypting ransomware malware created in 2016. It was initially titled "BitcoinBlackmailer", but later came to be known as "Jigsaw" due to featuring an image of Billy the Puppet from the Saw film franchise.[1] The malware encrypts computer files and gradually deletes them, demanding payment of a ransom to decrypt the files and halt the deletion.[2]

## History[edit]

Jigsaw was designed in April 2016 and released a week after creation.[1] It was designed to be spread through malicious attachments in spam emails.[3] Jigsaw is activated if a user downloads the malware program which will encrypt all user files and master boot record.[4] Following this, a popup featuring Billy the Puppet will appear with the ransom demand in the style of Saw's Jigsaw (one version including the "I want to play a game" line from the franchise) for Bitcoin in exchange for decrypting the files.[5] If the ransom is not paid within one hour, one file will be deleted.[5] Following this for each hour without a ransom payment, the amount of files deleted is exponentially increased each time from a few hundred to thousands of files until the computer is wiped after 72 hours.[2] Any attempt to reboot the computer or terminate the process will result in 1,000 files being deleted.[5] A further updated version also makes threats to dox the victim by revealing their personal information online.[6]

Jigsaw activates purporting to be either Firefox or Dropbox in task manager.[2] As Jigsaw stores the decryption key statically in the binary, it can be extracted from the binary using a hex editor or .NET decompiler to remove the encryption without paying the ransom.[1]

## Reception[edit]

The Register wrote that "Using horror movie images and references to cause distress in the victim is a new low."[1] In 2017, it was listed among 60 versions of ransomware that utilised evasive tactics in its activation.[7]

## References[edit]

1. ^ a b c d "Saw-inspired horror slowly deletes your PC's files as you scramble to pay the ransom". The Register. Retrieved 2018-02-20.
2. ^ a b c Osborne, Charlie (2016-04-22). "Tick, tock: Jigsaw ransomware deletes your files as you wait". ZDNet. Retrieved 2018-02-20.
3. ^ "Jigsaw ransomware: Saw-inspired malware deletes files bit by bit hourly until you pay". International Business times. 2016-04-14. Retrieved 2018-02-20.
4. ^ "Jigsaw ransomware wants to play a game with you". Geek.com. 2016-04-13. Archived from the original on 2018-07-18. Retrieved 2018-02-20.
5. ^ a b c "Jigsaw Ransomware Decrypted: Will delete your files until you pay the Ransom". Bleeping Computer. 2016-04-11. Retrieved 2018-02-20.
6. ^ Goodin, Dan (2016-06-28). "Meet Jigsaw, the ransomware that taunts victims and offers live support". Ars Technica. Retrieved 2018-02-20.
7. ^ "Minerva Labs Releases Evasive Malware 2017 Year in Review". Prnewswire.com. 2017-12-07. Retrieved 2018-02-20.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora (publication of 2009 events)
* Australian cyberattacks
* Operation Olympic Games
* Operation ShadowNet
* Operation Payback

|

2011|

* Canadian government
* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* PlayStation network outage
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism attack of June 25
* 2013 Yahoo! data breach
* Singapore cyberattacks

2014|

* Anthem medical data breach
* Operation Tovar
* 2014 celebrity nude photo leak
* 2014 JPMorgan Chase data breach
* 2014 Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Surkov leaks
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections
* 2016 Bitfinex hack

2017|

* SHAttered
* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster data breach
* Petya and NotPetya
* 2017 Ukraine ransomware attacks
* Vault7 data breach
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Atlanta cyberattack
* SingHealth data breach

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* Bulgarian revenue agency hack
* WhatsApp snooping scandal
* Jeff Bezos phone hacking incident

Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* Teamp0ison
* TDO
* UGNazi
* Ukrainian Cyber Alliance

Advanced
persistent threats|

* Bangladesh Black Hat Hackers
* Bureau 121
* Charming Kitten
* Cozy Bear
* Dark Basin
* DarkMatter
* Elfin Team
* Equation Group
* Fancy Bear
* GOSSIPGIRL (confederation)
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* Numbered Panda
* PLA Unit 61398
* PLA Unit 61486
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Stealth Falcon
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* xDedic
* Yemen Cyber Army

Individuals|

* Cyber Anakin
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* SS7 vulnerabilities (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Exactis (2018)
* Speculative Store Bypass (2018)
* Lazy FP state restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Dragonblood (2019)
* Microarchitectural Data Sampling (2019)
* BlueKeep (2019)
* Kr00k (2019)

Malware|

| 2010|

* Bad Rabbit
* Black Energy 2
* SpyEye
* Stuxnet

|

2011|

* Coreflood
* Alureon
* Duqu
* Kelihos
* Metulji botnet
* Stars

2012|

* Carna
* Dexter
* FBI
* Flame
* Mahdi
* Red October
* Shamoon

2013|

* CryptoLocker
* DarkSeoul

2014|

* Brambul
* Black Energy 3
* Carbanak
* Careto
* DarkHotel
* Duqu 2.0
* FinFisher
* Gameover ZeuS
* Regin

2015|

* Dridex
* Hidden Tear
* Rombertik
* TeslaCrypt

2016|

* Hitler
* Jigsaw
* KeRanger
* Necurs
* MEMZ
* Mirai
* Pegasus
* Petya and NotPetya
* X-Agent

2017|

* BrickerBot
* Kirk
* LogicLocker
* Rensenware
* Triton
* WannaCry
* XafeCopy

2018|

* VPNFilter

2019|

* Grum
* Joanap
* NetTraveler
* R2D2
* Tinba
* Titanium
* ZeroAccess botnet

* v
* t
* e

Saw

* Media

Films|

* Saw
* Saw II
* Saw III
* Saw IV
* Saw V
* Saw VI
* Saw 3D
* Jigsaw
* Spiral: From the Book of Saw
* Saw X
* Saw XI

Characters|

* John Kramer
* Amanda Young
* Mark Hoffman
* David Tapp
* Eric Matthews

Video games|

* Saw: The Video Game
* Saw II: Flesh & Blood
* Dead by Daylight: The Saw Chapter

Miscellaneous|

* Billy the Puppet
* "Hello Zepp"
* Saw – The Ride
* Scream Queens
* "Vindicators 3: The Return of Worldender"

* Category

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template