Kawa4096: A New Ransomware Group with Akira-Style Branding and Qilin-Like Notes

In June 2025, a new ransomware group known as Kawa4096 surfaced, launching disruptive attacks against multinational organisations in finance, education and services, with victims reported in both Japan and the United States.

According to AhnLab, “Kawa4096 is quickly gaining attention for its rapid and widespread activity… They maintain a data leak site on the Tor network, where they publicly disclose information about their victims.” The malware employs a double extortion tactic, exfiltrating data before encrypting files, and victims are directed to a dedicated claim URL on the group’s leak site.

It features Akira-style branding cues and uses a command-line driven approach: if launched without arguments it re-runs with the -all option to encrypt globally, while also supporting -d=<directory>, -dump and a 25% partial encryption strategy on 64 KB chunks.

The ransomware creates a mutex named SAY_HI_2025 to prevent multiple executions, excludes certain system files and directories, and deletes Volume Shadow Copies to hinder recovery, with a ransom note titled !!Restore-My-file-Kavva.txt that references stolen data and provides a Tor site and QTOX ID for negotiation. The note’s content and format reportedly bear a high degree of similarity to the Qilin ransomware, according to the same source.