Threat Intelligence Report June 24 - June 30 2025

Kawa4096 Ransomware

Kawa4096 (a.k.a. KaWaLocker) is a newly emerged ransomware group first observed publicly on June 27, 2025, when it launched its leak site on the dark web. The group employs double extortion tactics, encrypting victim files and threatening to publish stolen data unless a ransom is paid. Their operational style mirrors that of the Akira ransomware gang, especially in the design of their Tor-based leak portal, which features a retro terminal interface.

During the week of June 21 to June 27, Kawa4096 claimed responsibility for at least four confirmed breaches affecting organisations in the U.S. and Germany. While one breach occurred slightly earlier (June 20), it was disclosed within the week and is included in this analysis.

• No use of traditional clearnet infrastructure
• Communication solely over Tor, Tox, and OnionMail
• Initial access presumed via phishing and unauthorised RDP
• Strong focus on stealth, with ransomware binaries operating offline

Detailed TTPs

Initial Access – Spearphishing (T1566.001)
Victims received targeted phishing emails containing a malicious installer (shield.msi) or infected Office documents.

User Execution (T1204.002)
The user executed the payload (e.g., ran shield.msi), triggering the ransomware’s entry point—reported by the same threat platforms.

Process Injection (T1055)
Kawa4096 spawned a helper process and injected malicious code into elevated system processes such as svchost.exe, maintaining stealth.

Persistence via Service/Task (T1543.003)
The malware created a Windows service or scheduled task to persist across reboots.

Privilege Escalation & Defence Evasion
Techniques used include:

• Process injection (again, T1055)
• Disabling AV or security tools (T1562.001)
• Deleting Volume Shadow Copies (T1490)
• Clearing Event Logs (T1070.001)
  
  

Ransomware Execution (Encryption + Optional Wiping)
Kawa4096 encrypted files using ChaCha20 with RSA key exchange (T1486) and optionally wiped file segments (T1561).

Ransom Note Deployment & Extortion Set-Up (T1486 Impact)
The malware dropped !!RestoreMyfileKavva.txt containing instructions and links to Tor leak site and Tox chat, guiding victims on how to contact attackers.

MITRE ATT&CK Summary

Indicators of Compromise (IOCs)

Domains and Onion Services:

Tor Leak Site

kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd.onion

kawasax2ygoxytxtfjcy3a57vdyopj4k4c3m6rj5zht7io3t7g4wl3ad.onion

Delivery Filename: shield.msi

Ransom Note: !!Restore-My-file-Kavva.txt, referencing the Tor site and Tox

Contact Info:

• Tox ID: 6A340207246B47E37F6D094D2236E5C6242B6E4461EEF8021FED2C9855240C3E11AEE886FAAF
• Email: kawa4096@onionmail.org

SHA256 hash: f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617

SHA3-384 hash: cafd8e135dd873baa29218f17b55b44a83a1444afc380f94bfa5598a6ea00f0f60609658174ef40db963951cb8b1f2da

SHA1 hash:       bd30c87774c083a1003c0b9fb0a922b702302272

MD5 hash:          c3ce46d40b2893e30bf00fce72c2e1fa

Mitigation & Defensive Controls (with CE 5.0)

1. Email Gateway Hardening & User Awareness

• Block .msi files and macro-enabled documents at the email gateway.
• Educate users through phishing simulations and awareness campaigns.

2. Endpoint Behavioural Monitoring

• Detect and alert on:
  • Malicious PowerShell or script activity
  • Process injection into system services like svchost.exe
  • Shadow copy deletion commands
  • Clearing of Windows event logs
• Crystal Eye CE 5.0 uses host-based behaviour analytics and system call monitoring to identify these patterns in real-time.

3. Network Anomaly Detection & C2 Blocking

• Block outbound traffic to anonymising networks like Tor and encrypted .onion domains.
• CE 5.0’s Network Detection & Response engine alerts on such traffic and can automatically block these channels.

4. Privilege Management & Persistence Prevention

• Apply least-privilege principles to endpoints and servers.
• Enforce MFA for remote access and admin accounts.
• CE 5.0 monitors for unauthorised Windows service and scheduled task creation attempts (T1543.003).

5. Backup Strategy & Network Segmentation

• Implement immutable, offline backups using the 3-2-1 rule.
• Segment network zones to isolate critical systems.
• CE 5.0 includes visibility into lateral movement attempts and ransomware propagation attempts.

6. Incident Response Integration

• Ingest CE 5.0 alerts into SIEM/XDR solutions to automate containment and investigation workflows.
• CE 5.0 enriches its detections with contextual indicators and mapped MITRE TTPs.

7. Threat Intelligence & Signature Updates

• Crystal Eye CE 5.0 receives regular threat intelligence feeds and IDS/IPS signature updates to respond to new TTPs used by ransomware families like Kawa4096.

Ransomware Victims Worldwide

The United States continues to bear the brunt of global ransomware activity, accounting for an overwhelming 64.55% of all reported victims this week. This dominance reflects its vast digital infrastructure, high-value enterprise targets, and ongoing appeal to both ransomware-as-a-service (RaaS) operators and independent threat groups.

Israel and Canada each recorded 5.45%, marking them as high-interest targets—likely due to their advanced tech sectors, global business presence, and significant data holdings.

Germany followed with 3.64%, maintaining its status as a frequently targeted nation within Western Europe. The United Kingdom and Australia each saw 2.73%, indicating steady targeting of these well-connected economies.

Countries such as India, Spain, and Thailand each accounted for 1.82%, highlighting the global nature of ransomware operations and the increasing focus on Asia-Pacific and South Asia.

Meanwhile, a long list of nations—Turkey, Belgium, Argentina, Peru, Brazil, Serbia, Taiwan, Fiji, New Zealand, Sri Lanka, and United Arab Emirates—each reported 0.91% of total incidents. These figures emphasise that ransomware campaigns are far-reaching and increasingly opportunistic, impacting both major economies and smaller, less frequently targeted countries alike.