Jigsaw (ransomware)


Jigsaw is a form of encrypting ransomware malware created in 2016. It was initially titled "BitcoinBlackmailer" but later came to be known as Jigsaw due to featuring an image of Billy the Puppet from the Saw film franchise. The malware encrypts computer files and gradually deletes them unless a ransom is paid to decrypt the files.

History

Jigsaw was designed in April 2016 and released a week after creation. It was designed to be spread through malicious attachments in spam emails. Jigsaw is activated if a user downloads the malware programme which will encrypt all user files and master boot record. Following this, a popup featuring Billy the Puppet will appear with the ransom demand in the style of Saw's Jigsaw for bitcoin in exchange for decrypting the files. If the ransom is not paid within one hour, one file will be deleted. Following this for each hour without a ransom payment, the amount of files deleted is exponentially increased each time from a few hundred to thousands of files until the computer is wiped after 72 hours. Any attempt to reboot the computer or terminate the process will result in 1,000 files being deleted. A further updated version also makes threats to dox the victim by revealing their personal information online.
Jigsaw activates purporting to be either Firefox or Dropbox in task manager. As the code for Jigsaw was written within the.NET Framework, it can be reverse engineered to remove the encryption without paying the ransom.

Reception

The Register wrote that "Using horror movie images and references to cause distress in the victim is a new low." In 2017, it was listed among 60 versions of ransomware that utilised evasive tactics in its activation.