Janicab

Internal ID: osx.janicab

victims

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Patrick Wardle, this malware persists a python script as a cron job.

Steps:

1. Python installer first saves any existing cron jobs into a temporary file named '/tmp/dump'.

2. Appends its new job to this file.

3. Once the new cron job has been added 'python (~/.t/runner.pyc)' runs every minute.

Threat Analysis

Janicab is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

Ransomware Victims (41)

CTIWATCH tracks 41 organizations claimed as victims by Janicab on its data leak site, with attack dates, sectors and countries.

View full victims list →

External References

→https://archive.f-secure.com/weblog/archives/00002576.html

→https://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/

→https://sec0wn.blogspot.com/2018/12/powersing-from-lnk-files-to-janicab.html

→https://securelist.com/apt-trends-report-q3-2020/99204/

→https://securelist.com/deathstalker-mercenary-triumvirate/98177/

→https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131/

→https://www.macmark.de/blog/osx_blog_2013-08-a.php

→https://www.malwarology.com/2022/05/janicab-series-attibution-and-iocs/

→https://www.malwarology.com/2022/05/janicab-series-first-steps-in-the-infection-chain/

→https://www.malwarology.com/2022/05/janicab-series-further-steps-in-the-infection-chain/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

osx.janicab

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Janicab Victims (41)·Geopolitics Map·Search Janicab