Ransomware needs a way in. Stolen credentials are the cheapest one.
majinahanashi Ransomware Group
Ransomware group profile
Description
Majinahanashi is a financially motivated ransomware group that surfaced in June 2026, employing double-extortion tactics to encrypt files while threatening the disclosure of stolen data. The group is characterized by its use of unique Windows locker optimizations and a focus on non-English-speaking victims across various regions.
Key insights
- •Employs custom ransomware that encrypts files with the .majin extension using AES-256 encryption.
- •Utilizes double extortion tactics by demanding ransoms and threatening to publish stolen data on a dedicated Tor leak site.
- •Targets primarily non-English-speaking organizations in sectors such as e-commerce, manufacturing, and healthcare.
- •Strips away defense mechanisms by modifying registry keys and deleting system recovery options.
- •Implements complex network disruption tactics using the Windows Filtering Platform to hinder connectivity during attacks.
Threat Level & Status Breakdown
For majinahanashi · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for majinahanashi in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for majinahanashi
- 914ff51fb60247cf13897b1bc950a190
- 6f9e1371427be15a840c2de5eb1719a466af2016
- bd91d786841f5259430c1c90b454d9f8bf510186fe4d32a0998bd9b5a7916467
- e6ec7749e3d0f750fa53b5a7619d1e5af57673d236338b3a020d0f534ec5c15d
- d213bccd00f98d8af608186035bc8bf814e13364
- 7ee443b0530bb9fe4c36c0faafdeb6bc
- 20294fe9ec6b7763a8fd58f23be53be7
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for majinahanashi
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1045
T1045
T1569
T1569
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Affected countries(19)
Countries where this group has been reported to target or leak victims.