Kawa4096 is a ransomware and data-extortion group that emerged in June 2025, with reported targeting in countries including Japan and the United States. AhnLab describes a Tor leak site and ransomware that can encrypt selected directories or apply partial file encryption. The operation’s leak-site styling resembles Akira’s, while its ransom-note format resembles Qilin’s; those similarities do not establish a shared organization or collaboration.
Huntress documented a KawaLocker deployment, also identified as KAWA4096, involving compromised-account access over Remote Desktop Protocol, attempts to disable security tools and subsequent encryption. Its investigation also observed deletion of recovery copies and event logs. These are findings from a particular investigated intrusion, rather than proof of a uniform entry method or of the group’s responsibility for every alleged victim.
External listing names sbamh.org as a kawa4096 victim. Discovery was July 22, 2025; original publication is unknown. Comparitech reported alleged theft of 210 GB and purported samples, neither independently authenticated by the hospital.
