Jigsaw

Jigsaw is a Windows ransomware family created in 2016, initially titled BitcoinBlackmailer and later widely known as Jigsaw because it displays imagery of Billy the Puppet from the Saw film franchise. It is a .NET malware family, with analyzed samples obfuscated using Confuser, that encrypts victim files and appends the .fun or .FUN extension. It presents a ransom window themed around Saw, including taunting messages such as “I want to play a game with you,” and uses psychological pressure by threatening escalating file deletion over time. Reported behavior includes deleting a few files in the first 24 hours, a few hundred on the second day, a few thousand on the third day, deleting 1,000 files after a reboot, and ultimately deleting all files after 72 hours if payment is not made. Initial ransom demands reported in the content were $20 in Bitcoin, increasing over time up to $150 after 72 hours. Trend Micro researchers also reported that Jigsaw later added live support to help victims obtain bitcoin for payment.

In analyzed executions, Jigsaw copies itself into %APPDATA% as drpbx.exe and also copies a window-form component as firefox.exe. The ransom interface allows victims to view encrypted files and includes a decryption button that attempts to contact a command-and-control server to query a decryption key. Infections described in the content came from downloads hosted on 1fichier.com and from pornography websites, including a themed variant whose ransom message stated, “YOU ARE A PORN ADDICT. STOP WATCHING SO MUCH PORN. NOW YOU HAVE TO PAY,” and replaced the Billy image with pink flowers.

The content highlights that Jigsaw was poorly implemented: the encryption key was hardcoded in the binary/source code, enabling recovery through reverse engineering without paying. The source also reportedly exposed 100 Bitcoin wallet addresses intended for ransom payments. The malware is therefore notable both for its coercive deletion threats and for weak key management that enabled free decryption. The content also notes that public reporting and government advisory material have observed threat actors possessing or using publicly available encryption tools including Jigsaw.