A previously undocumented ransomware operation calling itself Majinahanashi has emerged as one of August 2026’s more active new entrants to the extortion landscape, racking up 18 claimed victims across 12 countries in barely six weeks of activity. Researchers at The Raven File first flagged the group publicly on August 14, though ransomware-tracking platforms show the earliest confirmed victim listing dates back to July 4, 2026.
Name and branding
The group’s name splits into two Japanese-derived roots: “majin” (referencing a djinn or malevolent spirit) and “hanashi” (story), together rendering roughly as “ghost stories.” The branding places it alongside a small cluster of recent Japanese-themed extortion crews — including Yurei and Tengu — that have adopted similar naming and iconography over the past year, though researchers have not established any code-level or infrastructure links between these operations beyond thematic similarity.
Victims and targeting
As of the most recent tracking update on August 23, Majinahanashi had listed 18 organizations on its leak site, spanning hospitality, retail and e-commerce, manufacturing, technology, and food production. Confirmed named victims include Colombian retailer PIO PIO, Portuguese food company Grupo Starfoods (starfoods.pt), Thai restaurant chain KT Restaurant, French electronics retailer Son-Video, UK hospitality operator The Margo Hotel, Swiss firm Camandona SA, and a US technology company listed as ALTAIR. An Italian radiology clinic has also been named as a victim, indicating the group is not avoiding healthcare-adjacent targets despite most listings clustering in retail and hospitality.
Geographic spread covers at least 12 countries, with Colombia, Italy, and the United States each accounting for two confirmed victims. Reported average victim revenue sits around $25 million, consistent with a mid-market rather than large-enterprise targeting profile. Ransomware-tracking data shows attack velocity up roughly 25% month over month, with an average 23.5-day gap between the initial compromise date and public listing on the leak site — a delay pattern consistent with a negotiation window before extortion escalation.
Technical profile
Samples analyzed by researchers are compiled in C/C++ and are notably compact, around 90 KB, with build timestamps dated July 2, 2026 — roughly two days before the earliest recorded victim attack, suggesting the toolset was freshly built for this campaign rather than reused from an older codebase. Encrypted files are appended with a .majin extension. The ransom note is dropped as README.txt and describes a hybrid encryption scheme — a unique per-file key wrapped under an offline master key retained by the operators — which is standard practice among modern RaaS-derived lockers and is designed to make brute-force or flaw-based decryption efforts (of the kind that succeeded against families like Key Group) far less likely.
The note claims backups and shadow copies were deliberately deleted, states that data was exfiltrated prior to encryption, and offers to decrypt two files free as proof of capability. Victims are given a seven-day deadline before the operators say they will publish the full dataset and notify regulators and affected data subjects — a pressure tactic increasingly common among leak-site operators seeking to compound reputational and regulatory risk. Contact is directed through qTOX and a ProtonMail address, with a case ID issued per victim (one documented sample used case ID CD42A401).
Leak site infrastructure
The group’s Tor-hosted data leak site runs on nginx in front of a Python/Flask backend and uses countdown timers alongside victim listings — a now-standard double-extortion presentation. Ahead of full data releases, the operators have been observed publishing samples of stolen personally identifiable information as proof of compromise, a step intended to increase pressure during the negotiation window. Infrastructure uptime has been measured at roughly 97.8% over a 30-day window, suggesting a reasonably resourced and stable hosting setup rather than a fly-by-night operation.
Assessment
No free decryptor is currently available for Majinahanashi, and no attribution to a known threat actor, affiliate cluster, or leaked builder source has been publicly confirmed. Given the freshly compiled toolset, active leak-site cadence, and geographically diverse mid-market targeting, defenders — particularly in retail, hospitality, and food/manufacturing sectors — should treat this as an actively developing threat and monitor ransomware-tracking feeds for updated indicators as more samples surface.