Full Report
Thanks in large part to our customer base, Huntress sees a great deal of interesting activity, particularly from threat actors (but also from admins). Part of that activity includes not just ransomware variants that Huntress hasn’t seen before, but also variants that may not have been documented via any public means. Further, when these incidents occur, Huntress very often gets a detailed look at the threat actor’s activity, including commands and their timing.
Analysis Summary
# Incident Report: Deployment of KawaLocker Ransomware
## Executive Summary
In August 2025, Huntress analysts identified an intrusion involving the deployment of KawaLocker (also known as KAWA4096) ransomware. The threat actor gained initial access via compromised RDP credentials and utilized specialized tools, including HRSword and China-based kernel drivers, to disable security software before encrypting data. The attack was characterized by manual intervention and the use of legitimate administrative tools like PsExec to move laterally.
## Incident Details
- **Discovery Date:** August 2025
- **Incident Date:** August 8, 2025
- **Affected Organization:** Redacted
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** August 8, 2025
- **Vector:** Remote Desktop Protocol (RDP)
- **Details:** The threat actor logged into a victim endpoint using a compromised account.
### Lateral Movement
- **Reconnaissance:** The actor ran `advanced_port_scanner.exe` to map the internal infrastructure, saving results to `1.txt`.
- **Technique:** Used `PsExec.exe` to push a batch file (`1.bat`) to multiple hosts listed in the discovery file.
- **Action:** Modified registry keys to enable RDP (`fDenyTSConnections = 0`) and disabled the firewall on additional systems to facilitate broader access.
### Data Exfiltration/Impact
- **Impact:** The KawaLocker ransomware (binary `e.exe`) was manually executed targeting specific volumes (e.g., `E:\`).
- **Encryption:** Files were encrypted; the ransom note used is noted to be nearly identical to the Qilin ransomware variant.
### Detection & Response
- **Discovery:** Huntress EDR telemetry flagged the crashing of security services and the installation of suspicious kernel drivers.
- **Response:** Analysts identified the use of the `HRSword` tool and unauthorized driver installations (`sysdiag.sys`), allowing for rapid containment and remediation recommendations.
## Attack Methodology
- **Initial Access:** Valid Accounts (RDP).
- **Persistence:** Enabled RDP on secondary systems via registry modification.
- **Privilege Escalation:** Manual execution of commands with administrative privileges gained via compromised credentials.
- **Defense Evasion:** Used `kill.exe`, `HRSword`, and `sc.exe` to stop and delete security services; deployed signed kernel drivers (`sysdiag.sys`, `hrwfpdr.sys`) to bypass/disable security tooling.
- **Discovery:** `tasklist.exe`, `advanced_port_scanner.exe`.
- **Lateral Movement:** `PsExec`, RDP.
- **Impact:** Data Encrypted for Impact (KawaLocker).
## Impact Assessment
- **Financial:** Unknown; potential ransom demand.
- **Data Breach:** Encryption of the `E:\` volume; data leak site associated with KawaLocker (Akira-like design).
- **Operational:** Disruption of services on encrypted volumes and temporary disabling of security infrastructure.
- **Reputational:** Potential exposure of data on the KawaLocker leak site.
## Indicators of Compromise
- **File Indicators:**
- `kill.exe`
- `HRSword.bat`
- `sysdiag.sys` (Huorong Network Technology signed)
- `hrwfpdr.sys` (Huorong Network Technology signed)
- `advanced_port_scanner.exe`
- `e.exe` (KawaLocker Ransomware)
- **Behavioral Indicators:**
- Registry modification: `HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server /v fDenyTSConnections /d 0`
- Service commands: `sc stop`, `sc delete` targeting security agents.
- Execution of 7-Zip self-extracting files in `\AppData\Local\Temp\`.
## Response Actions
- **Containment:** Isolation of affected endpoints to prevent further encryption.
- **Eradication:** Removal of threat actor tools (`HRSword`, scanners) and deletion of unauthorized kernel drivers via Service Control Manager.
- **Recovery:** Restoration of encrypted data from backups (if available) and resetting of compromised account credentials.
## Lessons Learned
- **Credential Hygiene:** The use of compromised RDP accounts highlights the need for Multi-Factor Authentication (MFA) on all remote access points.
- **Driver Monitoring:** Threat actors are increasingly using legitimate but niche security drivers (BYOVD - Bring Your Own Vulnerable Driver or using third-party tools like Huorong) to kill EDR processes.
- **Visibility:** Rapid detection of "service crashing" events is a critical indicator of a manual ransomware deployment in progress.
## Recommendations
- **Enforce MFA:** Implement Multi-Factor Authentication for all RDP and VPN connections.
- **RDP Hardening:** Disable RDP where not required; implement Account Lockout policies and restrict RDP access to specific IP ranges (VPN only).
- **Driver Blocklisting:** Use Windows "Vulnerable Driver Blocklist" or similar EDR features to prevent the loading of known tools used by attackers to disable security software.
- **Audit Administrative Tools:** Monitor the use of `PsExec` and port scanners within the environment.