Majinahanashi — Ransomware Profile
Majinahanashi is a Japanese-themed double-extortion ransomware operation whose data leak site published its first victim on 27 June 2026. Symantec reports that a successful compromise appends a .majin extension to encrypted files, that the group runs a non-vanity Tor leak site, and that it publishes stolen personally identifiable information as proof of compromise before releasing full datasets. Analysis by The Raven File found two samples compiled in C/C++ on 2 July 2026 that encrypt files with AES-256 using a per-file key wrapped by an RSA public key embedded in the binary, and that delete volume shadow copies, clear event logs and disable recovery and boot options before encrypting. Symantec assesses that the actor focuses on mid-sized enterprises globally, with average victim revenues of around 25 million dollars.
IntelFusions coverage (1)
Tools & malware
- Majinahanashi ransomware (majin.exe) Ransomware encryptor (C/C++, AES-256 with RSA key wrapping)
Recent claimed victims
Vendor research
Read the full analysis on IntelFusions