MA

Majinahanashi Ransomware

Active

Threat actor group tracked in the global ransomware database ยท Last disclosure: Sep 1, 2026

Ransomware-as-a-Service (RaaS) Double Extortion Target: Other
22
Total Victims
0.1% of all tracked
14
Countries Targeted
8
Sectors Targeted
2026
First Seen

ThreatAI Analysis

Compiled from the ransomware.live profile for Majinahanashi and from this database. Figures and technique mappings are quoted from the source data, not inferred.

A mysterious threat actor named Majinahanashi has been responsible for attacks targeting 22 victims across 14 countries, with the United States, Spain, and Italy feeling its full force in sectors like Other, Hospitality, and Retail & E-Commerce.

Recorded activity

Disclosures attributed to Majinahanashi in this database run from August 2026 to September 2026, totalling 22 victims โ€” 0.1% of everything tracked here. Majinahanashi has listed victims in 14 countries in this database, most often United States, followed by Colombia and Italy. The sectors appearing most in its listings are Other, Hospitality, Retail & E-Commerce.

Threat Actor Analysis

Majinahanashi is a ransomware threat group that has disclosed 22 victims in publicly accessible leak site data, representing 0.1% of all ransomware attacks tracked in this database. The earliest victim disclosure attributed to Majinahanashi in our dataset dates to August 2026.

Geographically, Majinahanashi has targeted organisations in 14 countries. The most frequently targeted nation is United States with 2 victim organisations. Other heavily targeted nations include Colombia, Italy, Spain.

Industry-wise, Majinahanashi shows a concentration in the Other, Hospitality, Retail & E-Commerce sectors. These industries are frequently targeted because they manage sensitive data, critical operations, or have lower tolerance for operational downtime โ€” conditions that increase ransom payment likelihood.

Like most modern ransomware operations, Majinahanashi likely employs a double extortion model: encrypting victim files while simultaneously exfiltrating data, creating dual pressure to pay the ransom. Victim organisations that refuse payment face having their data published on the group's dark web leak site.

Note: This profile is generated from public leak site disclosures aggregated via the ransomware.live API. Data is updated automatically. The table below lists the 22 most recent of the 22 disclosures we hold for this group; use the link beneath it to page through all of them.

Recent Victim Disclosures (showing 22 of 22)

# Organization Country Sector Date
1 TERRACOM & MONTCAU terracom.es ๐Ÿ‡ช๐Ÿ‡ธ Spain Other Sep 1, 2026
2 MONTCAU โ€” โ€” Aug 29, 2026
3 TERRA*** & MON**** terracom.es ๐Ÿ‡ช๐Ÿ‡ธ Spain Technology Aug 29, 2026
4 PCA Group Sdn. Bhd. ๐Ÿ‡ฒ๐Ÿ‡พ Malaysia Other Aug 25, 2026
5 PCA ***** โ€” โ€” Aug 23, 2026
6 Grand Ion Delemen Hotel โ€” Hospitality Aug 20, 2026
7 The Margo Hotel themargohotel.com ๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom Hospitality Aug 20, 2026
8 BONJOUR GROUP bonjourgroup.net ๐Ÿ‡ฎ๐Ÿ‡ณ India Other Aug 16, 2026
9 KT RESTAURANT ktr.co.th ๐Ÿ‡น๐Ÿ‡ญ Thailand Hospitality Aug 16, 2026
10 PIO PIO piopio.com.co ๐Ÿ‡จ๐Ÿ‡ด Colombia Retail & E-Commerce Aug 16, 2026
11 ALTAIR ๐Ÿ‡บ๐Ÿ‡ธ United States Technology Aug 12, 2026
12 CALICHE ๐Ÿ‡จ๐Ÿ‡ฑ Chile Energy & Utilities Aug 12, 2026
13 Camandona SA www.camandona.ch ๐Ÿ‡จ๐Ÿ‡ญ Switzerland โ€” Aug 12, 2026
14 CARIBE / SUBRA kalimancaribe.com ๐Ÿ‡จ๐Ÿ‡ด Colombia Other Aug 12, 2026
15 CDA centrodiagnosticocda.it ๐Ÿ‡ฎ๐Ÿ‡น Italy โ€” Aug 12, 2026
16 ETICOD โ€” โ€” Aug 12, 2026
17 Goccia S.p.A. www.joygioielli.com ๐Ÿ‡ฎ๐Ÿ‡น Italy Manufacturing Aug 12, 2026
18 GRUPO STARFOODS starfoods.pt ๐Ÿ‡ต๐Ÿ‡น Portugal Agriculture and Food Production Aug 12, 2026
19 SCHMITZ & NITTENWILM schmitz-nittenwilm.de ๐Ÿ‡ฉ๐Ÿ‡ช Germany Manufacturing Aug 12, 2026
20 SON-VIDEO Son-Video.com ๐Ÿ‡ซ๐Ÿ‡ท France Retail & E-Commerce Aug 12, 2026
21 UAB Biotecha ๐Ÿ‡ฑ๐Ÿ‡น Lithuania Healthcare Aug 12, 2026
22 WONDR DIAMONDS & D GEM MOUNT wondrdiamonds.com ๐Ÿ‡บ๐Ÿ‡ธ United States Retail & E-Commerce Aug 12, 2026

Frequently Asked Questions

What is Majinahanashi ransomware?

Majinahanashi is a ransomware threat group that has claimed 22 victims since its first known activity in August 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Majinahanashi attacked?

Majinahanashi has claimed 22 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, Colombia, Italy, Spain.

Which countries does Majinahanashi target?

Majinahanashi has attacked organizations in 14 countries. The top targeted countries are: United States, Colombia, Italy, Spain.

Which industries does Majinahanashi target?

Majinahanashi most frequently targets the Other, Hospitality, Retail & E-Commerce sectors based on victim disclosures in our database.

Is Majinahanashi still active?

Majinahanashi's most recent victim disclosure in our database was on September 1, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.