Kawa4096 Ransomware Targets Multinational Corporations to Steal Sensitive Data

In June 2025, a previously unknown ransomware group dubbed Kawa4096 emerged, quickly drawing attention for targeting multinational organisations across finance, education and services in countries including Japan and the United States. The operation is described as organized, operates a Tor-hosted data exfiltration portal where stolen files and victim details are displayed, and follows a double extortion model with both encryption and the threat of public data leaks.

Each victim is assigned a unique claim URL, indicating centralised control and tracked negotiations. The malware uses a self-restarting routine with a -all option to encrypt, and employs a partial encryption approach where large files are split into 64 KB chunks with 25% encrypted, while smaller files may receive full or weak partial encryption; Salsa20 is the cipher and encrypted files are renamed with a dot and random characters.

The ransom note mirrors Qilin ransomware, and the malware blocks shadow copies via WMI to hinder recovery, with AhnLab’s diagnostics noting detections and providing remediation guidance for Kawa4096 incidents.