Kawa4096 / Kawalocker
Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education, and services sectors primarily in the US and Japan, using partial-encryption (25% of each file chunk) with Salsa20 and a leak site styled after Akira's retro terminal aesthetic, claiming at least 11 victims.
Victims
17
First Victim
2025-06-19
(est. attack date)
Discovery Date
2025-06-27
Last Seen
2025-07-29
Inactive Since
1yr
more than
Avg Delay
8.3
days
Infostealer
55.6%
victims with domain
Countries
3
hit
Uptime
0.0% avg (30d)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Kawa4096 | No | 2026-08-22T08:53:02 |
kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd.onion
|
Target
Top 5 Activity Sectors
- Healthcare 3
- Financial Services 2
- Technology 1
- Government & Defense 1
- Retail & E-Commerce 1
Top 5 Countries
-
United States
11
-
Japan
3
-
Germany
2
Heatmap
Ransom Notes (2)
YARA Rules (1)
Indicators of Compromise (IoCs) (3)
Email
1
Hash SHA256
1
Tox
1
Victims (17)
