Loading story…
A newly observed ransomware group called Majinahanashi has launched a double-extortion campaign against organizations primarily in non-English-speaking countries, claiming about 15 victims and concentrating on the e-commerce and manufacturing sectors. The operators run a Tor-based leak site and archive servers, publish victim previews and countdown timers, and use contact channels including ProtonMail and qTox while reportedly demanding at least $15,000 in ransom. Reporting indicates the operation may involve at least two members and uses the slogan "DECISION REQUIRES CLARITY."
The malware is a Windows ransomware family written in C/C++ that appends the .MAJIN extension and encrypts files with AES-256 using RSA-wrapped per-file keys. Analysis shows it can establish persistence through a Windows service, delete recovery artifacts, disable security tooling, and evade or hinder defenses through features such as lock-screen display, wallpaper hijacking, and network-control functions tied to the Windows Filtering Platform. Researchers also linked the activity to tools including Mimikatz and Advanced IP Scanner, underscoring a capable but still mid-tier ransomware operation with active leak-site maintenance.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
The Raven File published an initial threat-intelligence profile of Majinahanashi, describing it as a newly observed ransomware group with a Tor-based leak site, double-extortion tactics, and about 15 listed victims concentrated in non-English-speaking countries. The report also documented technical details of the malware, infrastructure, and operator communications.
Two observed Majinahanashi ransomware samples were described as roughly 90 KB Windows C/C++ binaries with creation dates set to 2 July 2026. The samples used AES-256 with RSA-wrapped per-file keys and appended the .MAJIN extension.
Reporting states the group's leak site was updated regularly between July 6 and August 11, 2026, instead of posting all victims at once. The site used countdown timers and proof-of-hack previews as part of a double-extortion workflow.
The first known victim leak attributed to the Majinahanashi ransomware operation appeared on its leak site, marking the group's earliest explicitly dated public activity. Later reporting said the group ultimately listed about 15 victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new ransomware group known as **Gentlemen** has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific `--password` argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection. Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Jun 29, 2026
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026