Cyberdudebivash

Kawa4096 Ransomware — Security Threat Analysis Report By CyberDudeBivash • Last updated: 22 September 2025 (IST)

Executive Snapshot

  • What’s new: Kawa4096 (a.k.a. KawaLocker) surfaced in June 2025 with a Tor leak site mimicking Akira and a ransom note closely resembling Qilin—an intentional brand-mimicry play to boost credibility and pressure victims. trustwave.com+1
  • How it hits: Operators use RDP with compromised creds in at least one observed case, drop tools (e.g., HRSword, kill.exe) to disable security, then deploy the encryptor, delete Volume Shadow Copies, clear Windows logs, and self-delete. Huntress
  • Where it bites: Public victim listings and telemetry point to U.S., Japan, and Germany among top targets; healthcare, financial services, and public sector appear in early tallies. ransomware.live
  • Crypto details (vary by sample): Some analyses note hybrid crypto (ChaCha20 + Curve25519); others describe partial chunk encryption using Salsa20 to speed impact. Expect variant drift across campaigns. watchguard.com+1

Threat Anatomy (What Sets Kawa4096 Apart)

Branding & Pressure Tactics

  • Leak site deliberately styled like Akira; ransom note text and layout nearly identical to Qilin—a psychological tactic to piggyback on “known-dangerous” brands and coerce fast payment. trustwave.com+1

Execution & Impact Flow (high level)

  1. Initial access: Observed use of RDP logins with compromised accounts. Huntress
  2. Defense evasion: Deployed HRSword utilities and signed drivers (hrwfpdrv.sys, sysdiag.sys) to monitor/disable security tooling. Huntress
  3. Propagation setup: Enabled RDP across hosts and pushed commands via PsExec; then dropped the encryptor. Huntress
  4. Data theft & extortion: Double-extortion—exfil first, encrypt later; Tor leak site lists victims. ASEC
  5. Impact anti-recovery: Delete VSS via vssadmin/WMIC and clear logs with wevtutil (defender clue). trustwave.com+1

Ransom-Note & File Markers

  • Ransom note filenames seen: !!Restore-My-file-kavva.txt and !!Restore-My-file-K1Vva.txt (variant differences across incidents). watchguard.com+1
  • Encrypted file pattern: <name>.<ext>.<9-char alphanumeric>; extensions and exclusions governed by an embedded configuration. watchguard.com+1

Cryptography (per public reporting)

  • WatchGuard: ChaCha20 for files, Curve25519 for key exchange (hybrid). watchguard.com
  • AhnLab ASEC: Salsa20 with partial (25%) chunk encryption for speed on large files. (These can both be true across different samples.) ASEC

Known Victimology & Activity (OSINT)

  • Ransomware.live (dataset 22 Sep 2025 UTC) lists ~17 victims, mainly U.S., Japan, and Germany; sectors include financial services, healthcare, and public sector. ransomware.live
  • Cisco Talos notes ransomware uptick in Japan H1-2025 and mentions Kawa4096 possibly linked to two JP incidents. Cisco Talos Blog

MITRE ATT&CK Mapping (defender-focused)

  • Initial Access: Valid Accounts (T1078) / Remote Services: RDP (T1021.001). Huntress
  • Discovery/Lateral: Remote Service modification & enumeration (PsExec usage—Execution via SCM, T1569.002). Huntress
  • Defense Evasion: Impair Defenses (T1562), signed driver abuse (tooling via HRSword). Huntress
  • Credential Access: (not confirmed; monitor for infostealer overlap in your env).
  • Exfiltration: Exfiltration to attacker-controlled infrastructure (double-extortion model). ASEC
  • Impact: Data Encrypted for Impact (T1486); Inhibit System Recovery (T1490) via vssadmin/WMIC; Indicator Removal on Host (T1070) via wevtutil cl. trustwave.com+1

Rapid Defense Playbook (90-Minute Triage)

  1. Contain & verify scope
    • Isolate suspected hosts; pull EDR timeline around RDP logons and executions of vssadmin.exe, wmic shadowcopy delete, and wevtutil cl. trustwave.com+1
  2. Hunt for operator tools
    • Look for HRSword binaries (s.exe) and drivers (hrwfpdrv.sys, sysdiag.sys), kill.exe, advanced_port_scanner.exe; treat presence as malicious. Huntress
  3. Stop the spread
    • Revoke suspicious RDP sessions and disable recently enabled RDP across servers pushed by batch/REG edits (see Huntress case). Huntress
  4. Restore with integrity
    • Assume VSS destroyed; pivot to immutable/offline backups where available; rebuild from known-good images.
  5. Block & watch
    • Egress policy: deny by default for servers; allowlist business destinations.
    • DNS/Proxy: sinkhole known .onion gateways and prevent Tor bootstrapping (policy + egress).
    • SIEM: alert on log clear events and shadow-copy deletions.
  6. Identity cleanup
    • Reset credentials for any RDP-used accounts; enforce FIDO2/passkeys or strong MFA; audit local admins and PsExec usage.

Hardening Checklist (Next 48 Hours)

  • RDP: restrict to jump hosts/VPN; enforce network-level auth, MFA, and geo/ASN blocks.
  • EDR/AV: tamper-protection “on”; alert on service crashes and driver loads for unknown publishers.
  • Backups: immutable snapshots + tested restore; block backup networks from production auth domains.
  • Least privilege: remove standing local admin; enable JIT elevation for IT.
  • Email & web: quarantine archive/exe attachments by policy; disallow LOLBins as child processes from Office.
  • Telemetry: forward Sysmon/EDR events; watch for vssadmin, wmic shadowcopy, wevtutil cl, sc.exe service edits. trustwave.com+1

Indicators of Compromise (safe view)

Do not visit .onion links. Keep them in threat-intel tooling only.

  • Leak / comms (Tor):
    • hxxp://kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd[.]onion
    • hxxp://kawasax2yghpkcxx5d5fegnjoucwxnjpxcxpfh2vjfx7drj66pnwl3ad[.]onion watchguard.com
  • Email: kawa4096@onionmail[.]org ransomware.live
  • qTox ID: 6A3402...E886FAAF (truncated for safety) ransomware.live
  • Sample hashes (SHA256):
    • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617 (encryptor) watchguard.com+1
    • e4fb852fed532802aa37988ef9425982d272bc5f8979c24b25b620846dac9a23 (e.exe) Huntress

What We Don’t Know (Yet)

  • Access vectors beyond RDP: Phishing, VPN appliance bugs, or supplier compromise may be in play—monitor advisories.
  • RaaS vs closed crew: No confirmed affiliate model; branding suggests style-borrowing, not proven ties. ASEC

Sources & Further Reading

  • Trustwave SpiderLabs — first full technical profile: Akira-style leak site; Qilin-like note; config fields; VSS deletion & log clearing behaviors; IoCs. trustwave.com
  • Huntress — live incident: RDP initial access, HRSword drivers/tools, PsExec propagation, VSS/log wipe, note/email artifacts. Huntress
  • AhnLab ASEC — brand mimicry analysis, partial encryption (Salsa20), mutex SAY_HI_2025, config internals. ASEC
  • WatchGuard Ransomware Tracker — aliases, hybrid crypto (ChaCha20 + Curve25519), ransom note name, Tor addresses, sample hash. watchguard.com
  • Ransomware.live — running OSINT: victims (~17 as of 22 Sep 2025), top countries/sectors, IoCs. ransomware.live
  • Cisco Talos (Japan H1-2025) — Kawa4096 possibly tied to two JP cases; JP SMB/manufacturing trend context. Cisco Talos Blog

CyberDudeBivash — Brand & Services 

CyberDudeBivash | Cybersecurity, AI & Threat Intelligence Network

  • Ransomware Rapid Response (24×7): triage, scoping, clean rebuilds, IR comms.
  • Hardening Sprint (2 weeks): RDP lockdown, EDR tamper-proofing, egress allowlists, backup/restore drills.
  • Detection Engineering: Sigma/EDR logic for vssadmin, wmic shadowcopy, wevtutil, driver loads, and PsExec misuse; ATT&CK-mapped coverage.
  • Board Pack: risk snapshot, SLA to green, post-incident evidence for regulators/insurers.

Book a rapid consult: https://www.cyberdudebivash.com/contact •&nbsp;Newsletter: CyberDudeBivash Threat Brief (weekly ransomware tradecraft + ready-to-deploy controls). https://www.linkedin.com/newsletters/cyberdudebivash-threatwire-7357235763907858432/

Affiliate Toolbox (clear disclosure)

Disclosure: If readers purchase via the links you add here, we may earn a commission at no extra cost. These tools augment (not replace) your security program:

  • EDR/XDR with strong tamper protection — detects/blocks service kills and driver abuse.
  • Immutable backup & recovery — snapshotting with air-gapped/obj-lock; verified restores.
  • MFA/Passkeys & PAM — reduce RDP credential replay and lateral movement.
  • EASM/ASM & CIEM — find exposed RDP/VPN, stale SPNs, and shadow identities.

FAQs

Q1: Is Kawa4096 a rebrand of Akira or Qilin?
No proof. Analyses say the branding and note are look-alikes—likely psychological pressure, not a confirmed codebase/crew overlap. trustwave.com+1

Q2: What single control stops most incidents you’ve seen?
Lock down RDP (MFA, allowlists, jump hosts) and tamper-protected EDR. In the Huntress case, RDP + security-tool disabling were pivotal. Huntress

Q3: Are shadow copies the weak link?
They’re the first target post-deployment. Monitor for vssadmin/WMIC shadowcopy deletions and auto-recreate immutable backups. trustwave.com+1

Q4: Should we block Tor?
Yes—egress controls should prevent Tor bootstrapping from servers. Keep .onion indicators in threat-intel only; don’t browse them. watchguard.com

Affiliate Toolbox (clearly disclosed)

Disclosure: If you buy via the links below, we may earn a commission at no extra cost to you. These items supplement (not replace) your security controls. This supports CyberDudeBivash in creating free cybersecurity content.

🚀 Learn Cybersecurity & DevOps with Edureka

🌐 cyberdudebivash.com | cyberbivash.blogspot.com#CyberDudeBivash #Kawa4096 #KawaLocker #Ransomware #DoubleExtortion #RDP #EDR #ImmutableBackups #ThreatIntel #MITREATTACK

Leave a comment

Design a site like this with WordPress.com
Get started