{
  "family": "jigsaw",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Ransomware:Win32/Jigsaw is a highly infamous and uniquely psychological ransomware family, immediately recognizable by its use of the 'Billy the Puppet' image from the *Saw* movie franchise. First appearing in 2016, Jigsaw differentiates itself from standard ransomware through intense temporal extortion: it actively and permanently deletes the victim's encrypted files at set intervals (usually every hour) until the ransom is paid.<br><br><b>Understanding Jigsaw Ransomware</b><br>To a victim, a Jigsaw infection is a high-stress, terrifying event. The desktop background is changed to a menacing image, and a countdown timer appears on the screen. The ransom note explicitly states that every hour, a batch of files will be permanently deleted, and if the computer is restarted or the ransomware process is terminated, it will 'punish' the user by deleting 1,000 files immediately. For incident responders, Jigsaw is a destructive wiper masquerading as ransomware, utilizing the .NET framework for rapid file enumeration and AES encryption.<br><br><b>Execution and Psychological Extortion</b><br>Jigsaw is typically distributed via spam emails or adware bundlers (`T1189`). Upon execution, it establishes persistence via the Registry Run keys or the Startup folder (`T1547.001`). It then rapidly enumerates the file system and encrypts user documents (appending extensions like `.fun`, `.btc`, or `.kkk`) using AES encryption (`T1486`). Once the initial encryption phase is complete, it drops the ransom note GUI (`T1491`). Crucially, a background thread monitors the system time; every hour, it selects a batch of encrypted files and physically deletes them from the disk (`T1485`). It also hooks system events; attempting to close the GUI or reboot the machine triggers a massive, punitive file deletion routine (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme psychological stress and permanent data loss if not handled correctly. EDR platforms will alert on rapid, massive file encryption followed by deliberate file deletion commands. The presence of the *Saw* puppet GUI and encrypted files with `.fun` or `.gws` extensions are definitive IoCs. Network logs will show connections to Bitcoin payment addresses.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1490",
    "T1486",
    "T1485",
    "T1491",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "CRITICAL: Do NOT turn off, restart, or attempt to terminate the ransomware process using Task Manager. This will trigger the punitive deletion of 1,000 files.",
    "Use a specialized tool (like Process Explorer run from a USB drive) to specifically suspend the active Jigsaw threads in memory before attempting termination.",
    "Once the process is safely suspended/terminated, locate and remove the autostart entries in the Registry and Startup folder.",
    "Do NOT pay the ransom. Decryption tools for older Jigsaw variants are freely available from projects like No More Ransom."
  ],
  "what_to_avoid": [
    "Do not panic and abruptly restart the computer; this is exactly what the malware is waiting for to delete bulk data.",
    "Avoid paying the ransom; due to flaws in Jigsaw's early implementations, the decryption keys are often hardcoded or extractable from memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}