← Back to Ransomware Chk
Kawa4096
aka KaWaLocker
Inactive
Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education, and services sectors primarily in the US and Japan, using partial-encryption (25% of each file chunk) with Salsa20 and a leak site styled after Akira's retro terminal aesthetic, claiming at least 11 victims.
17
Victims
Jun 27, 2025
First Discovered
Jul 29, 2025
Last Discovered
279
Days Inactive
11.1%
Infostealer
0/1
Sites Online
Top Sectors
Healthcare 2
Financial Services 2
Public Sector 1
Known Locations (1)
Kawa4096
kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd.onion
Victims (17)
********.org
US
Discovered: Jul 29, 2025 · Attack est.: Jul 28, 2025
********.org
**********.net
US
Discovered: Jul 27, 2025 · Attack est.: Jul 27, 2025
**********.net
**********.com
US
Discovered: Jul 27, 2025 · Attack est.: Jul 27, 2025
**********.com
sbamh.org
US
Healthcare
Discovered: Jul 22, 2025 · Attack est.: Jul 20, 2025
sbamh.org
carestlhealth.org
US
Healthcare
Discovered: Jul 22, 2025 · Attack est.: Jun 28, 2025
carestlhealth.org
*************.org
Discovered: Jun 30, 2025 · Attack est.: Jun 28, 2025
*************.org
www.ogr-jp.com
JP
Discovered: Jul 1, 2025 · Attack est.: Jun 28, 2025
www.ogr-jp.com
**********-*******.co.jp
JP
Discovered: Jun 30, 2025 · Attack est.: Jun 26, 2025
**********-*******.co.jp
tokiomarine-nichido.co.jp
JP
Financial Services
Discovered: Jul 1, 2025 · Attack est.: Jun 26, 2025
tokiomarine-nichido.co.jp
******.org
US
Discovered: Jun 27, 2025 · Attack est.: Jun 25, 2025
******.org
gatewaycsb.org
US
Public Sector
Discovered: Jul 7, 2025 · Attack est.: Jun 25, 2025
gatewaycsb.org
******.com
US
Discovered: Jun 27, 2025 · Attack est.: Jun 24, 2025
www.******.com
www.malonebailey.com
US
Financial Services
Discovered: Jun 30, 2025 · Attack est.: Jun 24, 2025
www.malonebailey.com
heimhaus.de
DE
Discovered: Jul 7, 2025 · Attack est.: Jun 22, 2025
www.heimhaus.de
******.de
DE
Discovered: Jun 27, 2025 · Attack est.: Jun 22, 2025
www.******.de
Morningsideservices
US
Discovered: Jun 27, 2025 · Attack est.: Jun 20, 2025
www.morningsideservices.com
icmconv.com
US
Discovered: Jul 22, 2025 · Attack est.: Jun 19, 2025
icmconv.com