Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Kawa4096
As of Oct 19, 2026, Kawa4096 has listed 11 confirmed victims on its leak site since Jun 19, 2025, 0.0% of all victims tracked by Brandefense. Its most targeted country is United States (63.6% of its victims) and its most targeted sector is Consulting.
Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education, and services sectors primarily in the US and Japan, using partial-encryption (25% of each file chunk) with Salsa20 and a leak site styled after Akira's retro terminal aesthetic, claiming at least 11 victims.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 11
- Rank By Victims
- #218
- Last Leak-Site Post
- Jul 27, 2025
- Top Country
- United States
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| June 2025 | 9 |
| July 2025 | 2 |
| August 2025 | 0 |
| September 2025 | 0 |
| October 2025 | 0 |
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Kawa4096 Victims.
Search all 11 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| **********.com adamdanyal.com | USUnited States | Technology | Not stated | |
| sbamh.org sbamh.org | USUnited States | Unknown | Not stated | |
| carestlhealth.org carestlhealth.org | USUnited States | Healthcare | Not stated | |
| ogr-jp.com ogr-jp.com | JPJapan | Consulting | Not stated | |
| **********-*******.co.jp co.jp | JPJapan | Unknown | Not stated | |
| tokiomarine-nichido.co.jp tokiomarine-nichido.co.jp | JPJapan | Financial Services | Not stated |
How They Operate.
Kawa4096's threat actor profile lists 13 ATT&CK techniques, 15 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Kawa4096 Targets.
History.
Busiest month on record: 9 confirmed victims
First seen in Brandefense data
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.