kawa4096 Ransomware
Also known as: KaWaLocker · Tracked since Jun 27, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education, and services sectors primarily in the US and Japan, using partial-encryption (25% of each file chunk) with Salsa20 and a leak site styled after Akira's retro terminal aesthetic, claiming at least 11 victims.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live