Ransomware - Jinn

Jinn
Aliases
JINN
Jinn v1.0
Decryptor Available
No
Description

Christian Cornea is a penetration tester and threat intelligence analyst who often chronicles his work on Medium. On November 12, 2024, he posted an article titled "How I hacked 100 hackers". This concise post explained how he established an alias ("HeapCrash") on BreachForums, a forum used by hackers, cybercriminals, researchers, and everything in between, with a ransomware builder honeypot. The post, titled "[Jinn Ransomware v1.0] Source Code Custom Ransomware Builder - No detections", explained the high-level features of Jinn ransomware and contained the source code to build the executables. The catch is that Christian embedded a backdoor into the builder that affected over 100 hackers or potential users. The Medium post by Christian in the References & Publications section explains the process.

Ransomware Type
Builder
Crypto-Ransomware
Imitation
First Seen
Last Seen
Threat Actors
Type
Actor
Individual
HeapCrash
Extortion Types
Pseudo-Extortion
Encryption
Type
Symmetric
Files
AES
Samples (SHA-256)
79af365f84256cae13bad1da3e5c9d1607d5f4f5207e56f51652fb85f4f06766