Saw is a variant of the Xorist family that appends .saw to files. It writes a Russian-language note called КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt, shows the same text in a pop-up that becomes unreadable on systems without Cyrillic support, and sets a wallpaper of the puppet from the horror film series it is named after. The note threatens to sell data, wipe drives and damage hardware if the machine is restarted, yet gives no way to reach the attacker. No actual theft has been shown.
Sources: In-house research
File extensions: .saw
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-26.
Data exfiltration risk: Likely — The note threatens to sell the victim's data, but no analysis shows exfiltration.
Systems typically targeted: Windows PCs
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161