Description
Jigsaw is ransomware that encrypts files on infected systems and progressively deletes them until the victim pays the ransom. Its escalating deletion schedule, including files lost with each hour of delay and on every reboot, pressured victims into fast decisions, and it also deleted files if users tried to interfere. The family spread through malicious email attachments in 2016, and researchers later published decryption tools for many of its variants.
Stats
- First seen
- April 2022
- Last seen
- September 2026
Also known as
JigSaw
Alert name variants
| Alert Name |
|---|
| ByteCode-MSIL.Ransomware.Jigsaw |
| ByteCode-MSIL.Ransomware.JigSaw |
| Gen:Variant.MSIL.Ransom.Jigsaw.2 |
| Gen:Variant.Ransom.Jigsaw.10 |
| Generic.MSIL.Ransomware.Jigsaw.007FE356 |
| Generic.MSIL.Ransomware.Jigsaw.01EEF1FC |
| Generic.MSIL.Ransomware.Jigsaw.1764E21D |
| Generic.MSIL.Ransomware.Jigsaw.1C5EBC9F |
| Generic.MSIL.Ransomware.Jigsaw.25F79FEF |
| Generic.MSIL.Ransomware.Jigsaw.3735A07F |