Kawa4096
Kawa4096 is a ransomware group with a financial motive, tracked by Brandefense. It targets 3 sectors, including Government and Finance, in 3 countries, including the United States and Germany. It uses 13 MITRE ATT&CK techniques.
Also known as
- KaWaLocker
- Techniques
- 13
- Exploited CVEs
- No CVE data
- First seen
- Jun 1, 2025
- Record updated
Who They Target.
Sectors · 3
Countries · 3
About Kawa4096.
Kawa4096 is a ransomware group that emerged in June 2025, targeting multinational corporations across finance, education, and services sectors primarily in the US and Japan, using partial-encryption (25% of each file chunk) with Salsa20 and a leak site styled after Akira's retro terminal aesthetic, claiming at least 11 victims.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.