Kawabunga, Dude, You’ve Been Ransomed!

KawaLocker (KAWA4096) ransomware was deployed in a compromised environment after RDP access; the attacker used HRSword and other tooling to identify and disable security products, installed drivers, propagated via PsExec, and executed e.exe to encrypt files on the E: volume. Huntress captured event log evidence, recovered the ransom note and encrypted file list, observed post-encryption cleanup (shadow copy deletion, event log clearing, self-deletion), and published IOCs and TTPs used to detect and remediate similar incidents.