Kawa4096 Ransomware — Security Threat Analysis Report By CyberDudeBivash • Last updated: 22 September 2025 (IST)

-

 


Executive Snapshot

  • What’s new: Kawa4096 (a.k.a. KawaLocker) surfaced in June 2025 with a Tor leak site mimicking Akira and a ransom note closely resembling Qilin—an intentional brand-mimicry play to boost credibility and pressure victims. trustwave.com+1

  • How it hits: Operators use RDP with compromised creds in at least one observed case, drop tools (e.g., HRSword, kill.exe) to disable security, then deploy the encryptor, delete Volume Shadow Copies, clear Windows logs, and self-delete. Huntress

  • Where it bites: Public victim listings and telemetry point to U.S., Japan, and Germany among top targets; healthcare, financial services, and public sector appear in early tallies. ransomware.live

  • Crypto details (vary by sample): Some analyses note hybrid crypto (ChaCha20 + Curve25519); others describe partial chunk encryption using Salsa20 to speed impact. Expect variant drift across campaigns. watchguard.com+1

Threat Anatomy (What Sets Kawa4096 Apart)

Branding & Pressure Tactics

  • Leak site deliberately styled like Akira; ransom note text and layout nearly identical to Qilin—a psychological tactic to piggyback on “known-dangerous” brands and coerce fast payment. trustwave.com+1

Execution & Impact Flow (high level)

  1. Initial access: Observed use of RDP logins with compromised accounts. Huntress

  2. Defense evasion: Deployed HRSword utilities and signed drivers (hrwfpdrv.sys, sysdiag.sys) to monitor/disable security tooling. Huntress

  3. Propagation setup: Enabled RDP across hosts and pushed commands via PsExec; then dropped the encryptor. Huntress

  4. Data theft & extortion: Double-extortion—exfil first, encrypt later; Tor leak site lists victims. ASEC

  5. Impact anti-recovery: Delete VSS via vssadmin/WMIC and clear logs with wevtutil (defender clue). trustwave.com+1

Ransom-Note & File Markers

  • Ransom note filenames seen: !!Restore-My-file-kavva.txt and !!Restore-My-file-K1Vva.txt (variant differences across incidents). watchguard.com+1

  • Encrypted file pattern: <name>.<ext>.<9-char alphanumeric>; extensions and exclusions governed by an embedded configuration. watchguard.com+1

Cryptography (per public reporting)

  • WatchGuard: ChaCha20 for files, Curve25519 for key exchange (hybrid). watchguard.com

  • AhnLab ASEC: Salsa20 with partial (25%) chunk encryption for speed on large files. (These can both be true across different samples.) ASEC

Known Victimology & Activity (OSINT)

  • Ransomware.live (dataset 22 Sep 2025 UTC) lists ~17 victims, mainly U.S., Japan, and Germany; sectors include financial services, healthcare, and public sector. ransomware.live

  • Cisco Talos notes ransomware uptick in Japan H1-2025 and mentions Kawa4096 possibly linked to two JP incidents. Cisco Talos Blog

MITRE ATT&CK Mapping (defender-focused)

  • Initial Access: Valid Accounts (T1078) / Remote Services: RDP (T1021.001). Huntress

  • Discovery/Lateral: Remote Service modification & enumeration (PsExec usage—Execution via SCM, T1569.002). Huntress

  • Defense Evasion: Impair Defenses (T1562), signed driver abuse (tooling via HRSword). Huntress

  • Credential Access: (not confirmed; monitor for infostealer overlap in your env).

  • Exfiltration: Exfiltration to attacker-controlled infrastructure (double-extortion model). ASEC

  • Impact: Data Encrypted for Impact (T1486); Inhibit System Recovery (T1490) via vssadmin/WMIC; Indicator Removal on Host (T1070) via wevtutil cl. trustwave.com+1

Rapid Defense Playbook (90-Minute Triage)

  1. Contain & verify scope

    • Isolate suspected hosts; pull EDR timeline around RDP logons and executions of vssadmin.exe, wmic shadowcopy delete, and wevtutil cl. trustwave.com+1

  2. Hunt for operator tools

    • Look for HRSword binaries (s.exe) and drivers (hrwfpdrv.sys, sysdiag.sys), kill.exe, advanced_port_scanner.exe; treat presence as malicious. Huntress

  3. Stop the spread

    • Revoke suspicious RDP sessions and disable recently enabled RDP across servers pushed by batch/REG edits (see Huntress case). Huntress

  4. Restore with integrity

    • Assume VSS destroyed; pivot to immutable/offline backups where available; rebuild from known-good images.

  5. Block & watch

    • Egress policy: deny by default for servers; allowlist business destinations.

    • DNS/Proxy: sinkhole known .onion gateways and prevent Tor bootstrapping (policy + egress).

    • SIEM: alert on log clear events and shadow-copy deletions.

  6. Identity cleanup

    • Reset credentials for any RDP-used accounts; enforce FIDO2/passkeys or strong MFA; audit local admins and PsExec usage.

Hardening Checklist (Next 48 Hours)

  • RDP: restrict to jump hosts/VPN; enforce network-level auth, MFA, and geo/ASN blocks.

  • EDR/AV: tamper-protection “on”; alert on service crashes and driver loads for unknown publishers.

  • Backups: immutable snapshots + tested restore; block backup networks from production auth domains.

  • Least privilege: remove standing local admin; enable JIT elevation for IT.

  • Email & web: quarantine archive/exe attachments by policy; disallow LOLBins as child processes from Office.

  • Telemetry: forward Sysmon/EDR events; watch for vssadmin, wmic shadowcopy, wevtutil cl, sc.exe service edits. trustwave.com+1

Indicators of Compromise (safe view)

Do not visit .onion links. Keep them in threat-intel tooling only.

  • Leak / comms (Tor):

    • hxxp://kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd[.]onion

    • hxxp://kawasax2yghpkcxx5d5fegnjoucwxnjpxcxpfh2vjfx7drj66pnwl3ad[.]onion watchguard.com

  • Email: kawa4096@onionmail[.]org ransomware.live

  • qTox ID: 6A3402...E886FAAF (truncated for safety) ransomware.live

  • Sample hashes (SHA256):

    • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617 (encryptor) watchguard.com+1

    • e4fb852fed532802aa37988ef9425982d272bc5f8979c24b25b620846dac9a23 (e.exe) Huntress

What We Don’t Know (Yet)

  • Access vectors beyond RDP: Phishing, VPN appliance bugs, or supplier compromise may be in play—monitor advisories.

  • RaaS vs closed crew: No confirmed affiliate model; branding suggests style-borrowing, not proven ties. ASEC

Sources & Further Reading

  • Trustwave SpiderLabs — first full technical profile: Akira-style leak site; Qilin-like note; config fields; VSS deletion & log clearing behaviors; IoCs. trustwave.com

  • Huntress — live incident: RDP initial access, HRSword drivers/tools, PsExec propagation, VSS/log wipe, note/email artifacts. Huntress

  • AhnLab ASEC — brand mimicry analysis, partial encryption (Salsa20), mutex SAY_HI_2025, config internals. ASEC

  • WatchGuard Ransomware Tracker — aliases, hybrid crypto (ChaCha20 + Curve25519), ransom note name, Tor addresses, sample hash. watchguard.com

  • Ransomware.live — running OSINT: victims (~17 as of 22 Sep 2025), top countries/sectors, IoCs. ransomware.live

  • Cisco Talos (Japan H1-2025) — Kawa4096 possibly tied to two JP cases; JP SMB/manufacturing trend context. Cisco Talos Blog

CyberDudeBivash — Brand & Services 

CyberDudeBivash | Cybersecurity, AI & Threat Intelligence Network

  • Ransomware Rapid Response (24×7): triage, scoping, clean rebuilds, IR comms.

  • Hardening Sprint (2 weeks): RDP lockdown, EDR tamper-proofing, egress allowlists, backup/restore drills.

  • Detection Engineering: Sigma/EDR logic for vssadmin, wmic shadowcopy, wevtutil, driver loads, and PsExec misuse; ATT&CK-mapped coverage.

  • Board Pack: risk snapshot, SLA to green, post-incident evidence for regulators/insurers.

Book a rapid consult: https://www.cyberdudebivash.com/contact • Newsletter: CyberDudeBivash Threat Brief (weekly ransomware tradecraft + ready-to-deploy controls). https://www.linkedin.com/newsletters/cyberdudebivash-threatwire-7357235763907858432/

Affiliate Toolbox (clear disclosure)

Disclosure: If readers purchase via the links you add here, we may earn a commission at no extra cost. These tools augment (not replace) your security program:

  • EDR/XDR with strong tamper protection — detects/blocks service kills and driver abuse.

  • Immutable backup & recovery — snapshotting with air-gapped/obj-lock; verified restores.

  • MFA/Passkeys & PAM — reduce RDP credential replay and lateral movement.

  • EASM/ASM & CIEM — find exposed RDP/VPN, stale SPNs, and shadow identities.


FAQs

Q1: Is Kawa4096 a rebrand of Akira or Qilin?
No proof. Analyses say the branding and note are look-alikes—likely psychological pressure, not a confirmed codebase/crew overlap. trustwave.com+1

Q2: What single control stops most incidents you’ve seen?
Lock down RDP (MFA, allowlists, jump hosts) and tamper-protected EDR. In the Huntress case, RDP + security-tool disabling were pivotal. Huntress

Q3: Are shadow copies the weak link?
They’re the first target post-deployment. Monitor for vssadmin/WMIC shadowcopy deletions and auto-recreate immutable backups. trustwave.com+1

Q4: Should we block Tor?
Yes—egress controls should prevent Tor bootstrapping from servers. Keep .onion indicators in threat-intel only; don’t browse them. watchguard.com


Affiliate Toolbox (clearly disclosed)

Disclosure: If you buy via the links below, we may earn a commission at no extra cost to you. These items supplement (not replace) your security controls. This supports CyberDudeBivash in creating free cybersecurity content.

🌐 cyberdudebivash.com | cyberbivash.blogspot.com

#CyberDudeBivash #Kawa4096 #KawaLocker #Ransomware #DoubleExtortion #RDP #EDR #ImmutableBackups #ThreatIntel #MITREATTACK

Comments

Post a Comment

Popular posts from this blog

CyberDudeBivash Rapid Advisory — WordPress Plugin: Social-Login Authentication Bypass (Threat Summary & Emergency Playbook)

-
Image
  TL;DR: A class of vulnerabilities in WordPress social-login / OAuth plugins can let attackers bypass normal authentication flows and obtain an administrative session (or create admin users) by manipulating OAuth callback parameters, reusing stale tokens, or exploiting improper validation of the identity assertions returned by providers. If you run a site that accepts social logins (Google, Facebook, Apple, GitHub, etc.), treat this as high priority : audit, patch, or temporarily disable social login until you confirm your plugin is safe. This advisory gives you immediate actions, detection steps, mitigation, and recovery guidance. Why this matters (short) Social-login plugins often accept externally-issued assertions (OAuth ID tokens, authorization codes, user info). If the plugin fails to validate provider signatures, nonce/state values, redirect URIs, or maps identities to local accounts incorrectly , attackers can craft requests that the site accepts as authenticated. ...
Read more

Hackers Injecting Malicious Code into GitHub Actions to Steal PyPI Tokens CyberDudeBivash — Threat Brief & Defensive Playbook

-
Image
  SUMMARY  Attackers are modifying GitHub Actions workflows (via compromised accounts, malicious PRs, or forged commits) to add steps that exfiltrate PyPI (or other package registry) publishing tokens. With those tokens they publish backdoored packages or download private packages — a supply-chain multiplier. Defend by eliminating long-lived secrets, switching to OIDC/ephemeral credentials, hardening workflow controls, monitoring workflow changes and secret usage, and rotating tokens immediately if you suspect compromise. How attackers typically operate  Gain write access to repo or CI/CD config (via compromised developer account, stolen token, privilege abuse, or merge of malicious PR). Modify or add a workflow file that runs in the repo’s runner context (self-hosted or GitHub-hosted). Add steps that read repository secrets (e.g., PYPI_TOKEN ) or create credentials files ( ~/.pypirc ), then send the token to attacker-controlled endpoints or push a malicious p...
Read more

Exchange Hybrid Warning: CVE-2025-53786 can cascade into domain compromise (on-prem ↔ M365) By CyberDudeBivash — Cybersecurity & AI

-
Image
  Executive summary CVE-2025-53786 is a post-authentication elevation of privilege in Microsoft Exchange hybrid deployments . If an attacker first gains admin on an on-prem Exchange server , they can abuse the legacy “shared service principal” trust used by Hybrid Configuration to escalate into Exchange Online —potentially leading to full cloud+on-prem domain compromise . CISA issued Emergency Directive ED-25-02 with a deadline of 9:00 a.m. EDT on August 11, 2025 for U.S. federal agencies; Microsoft urges all hybrid customers to take the same steps: apply the April 2025 Hotfix Updates , migrate to the dedicated Exchange Hybrid app , and reset/clean up service principal credentials . cisa.gov +1 TECHCOMMUNITY.MICROSOFT.COM +1 Why this is dangerous: actions initiated from the on-prem Exchange side may not show up as obviously malicious in M365 audit trails, making cloud abuse harder to spot if you’ve not modernized the trust. TechRadar What is actually vulnerable? (trust...
Read more