Ransomware group profile · #171 by claimed victims

Kawa4096 ransomwarealso KaWaLocker

Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education, and services sectors primarily in the US and Japan, using partial-encryption (25% of each file chunk) with Salsa20 and a leak site styled after Akira's retro terminal aesthetic, claiming at least 11 victims.

Active First seen Jun 2025

17Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

3Countries hit

0Leak-site URLs tracked

29 Jul 2025Latest claim recorded

Victimology

Who Kawa4096 claims to have breached, from 17 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare3

Financial Services2

Retail & E-Commerce1

Other1

Technology1

Government & Defense1

Top countries

United States11

Japan3

Germany2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
******.org ******.org	Not Found	US	29 Jul 2025
********.net ********.net	Not Found	US	27 Jul 2025
********.com ********.com	Not Found	US	27 Jul 2025
icmconv.com icmconv.com	Technology	US	22 Jul 2025
carestlhealth.org carestlhealth.org	Healthcare	US	22 Jul 2025
sbamh.org sbamh.org	Healthcare	US	22 Jul 2025
gatewaycsb.org gatewaycsb.org	Government & Defense	US	7 Jul 2025
heimhaus.de heimhaus.de	Retail & E-Commerce	DE	7 Jul 2025
tokiomarine-nichido.co.jp tokiomarine-nichido.co.jp	Financial Services	JP	1 Jul 2025
www.ogr-jp.com ogr-jp.com	Other	JP	1 Jul 2025
www.malonebailey.com malonebailey.com	Financial Services	US	30 Jun 2025
********-***.co.jp ******-*****.co.jp	Not Found	JP	30 Jun 2025

All 17 Kawa4096 victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Kawa4096 is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Kawa4096 ransomware still active?

Kawa4096 is tracked as active. The most recent leak-site claim VULONE recorded is dated 29 July 2025.

How many victims has Kawa4096 claimed?

VULONE has recorded 17 leak-site victim claims attributed to Kawa4096 since June 2025, across 3 countries and 7 sectors.

Which industries does Kawa4096 target?

The sectors most often named on the Kawa4096 leak site are Healthcare, Financial Services, Retail & E-Commerce.

Which countries are most affected by Kawa4096?

Most Kawa4096 victims recorded by VULONE are located in United States, Japan, Germany.

Where does VULONE get Kawa4096 victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].