Majinahanashi Ransomware Targets E-Commerce and Manufacturing with Double Extortion

A newly observed ransomware group called Majinahanashi has launched a double-extortion campaign against organizations primarily in non-English-speaking countries, claiming about 15 victims and concentrating on the e-commerce and manufacturing sectors. The operators run a Tor-based leak site and archive servers, publish victim previews and countdown timers, and use contact channels including ProtonMail and qTox while reportedly demanding at least $15,000 in ransom. Reporting indicates the operation may involve at least two members and uses the slogan "DECISION REQUIRES CLARITY."

The malware is a Windows ransomware family written in C/C++ that appends the .MAJIN extension and encrypts files with AES-256 using RSA-wrapped per-file keys. Analysis shows it can establish persistence through a Windows service, delete recovery artifacts, disable security tooling, and evade or hinder defenses through features such as lock-screen display, wallpaper hijacking, and network-control functions tied to the Windows Filtering Platform. Researchers also linked the activity to tools including Mimikatz and Advanced IP Scanner, underscoring a capable but still mid-tier ransomware operation with active leak-site maintenance.