Majinahanashi Ransomware
ActiveThreat actor group tracked in the global ransomware database ยท Last disclosure: Sep 1, 2026
ThreatAI Analysis
Compiled from the ransomware.live profile for Majinahanashi and from this database. Figures and technique mappings are quoted from the source data, not inferred.
A mysterious threat actor named Majinahanashi has been responsible for attacks targeting 22 victims across 14 countries, with the United States, Spain, and Italy feeling its full force in sectors like Other, Hospitality, and Retail & E-Commerce.
Recorded activity
Disclosures attributed to Majinahanashi in this database run from August 2026 to September 2026, totalling 22 victims โ 0.1% of everything tracked here. Majinahanashi has listed victims in 14 countries in this database, most often United States, followed by Colombia and Italy. The sectors appearing most in its listings are Other, Hospitality, Retail & E-Commerce.
Threat Actor Analysis
Majinahanashi is a ransomware threat group that has disclosed 22 victims in publicly accessible leak site data, representing 0.1% of all ransomware attacks tracked in this database. The earliest victim disclosure attributed to Majinahanashi in our dataset dates to August 2026.
Geographically, Majinahanashi has targeted organisations in 14 countries. The most frequently targeted nation is United States with 2 victim organisations. Other heavily targeted nations include Colombia, Italy, Spain.
Industry-wise, Majinahanashi shows a concentration in the Other, Hospitality, Retail & E-Commerce sectors. These industries are frequently targeted because they manage sensitive data, critical operations, or have lower tolerance for operational downtime โ conditions that increase ransom payment likelihood.
Like most modern ransomware operations, Majinahanashi likely employs a double extortion model: encrypting victim files while simultaneously exfiltrating data, creating dual pressure to pay the ransom. Victim organisations that refuse payment face having their data published on the group's dark web leak site.
Note: This profile is generated from public leak site disclosures aggregated via the ransomware.live API. Data is updated automatically. The table below lists the 22 most recent of the 22 disclosures we hold for this group; use the link beneath it to page through all of them.
Recent Victim Disclosures (showing 22 of 22)
| # | Organization | Country | Sector | Date |
|---|---|---|---|---|
| 1 | TERRACOM & MONTCAU terracom.es | ๐ช๐ธ Spain | Other | Sep 1, 2026 |
| 2 | MONTCAU | โ | โ | Aug 29, 2026 |
| 3 | TERRA*** & MON**** terracom.es | ๐ช๐ธ Spain | Technology | Aug 29, 2026 |
| 4 | PCA Group Sdn. Bhd. | ๐ฒ๐พ Malaysia | Other | Aug 25, 2026 |
| 5 | PCA ***** | โ | โ | Aug 23, 2026 |
| 6 | Grand Ion Delemen Hotel | โ | Hospitality | Aug 20, 2026 |
| 7 | The Margo Hotel themargohotel.com | ๐ฌ๐ง United Kingdom | Hospitality | Aug 20, 2026 |
| 8 | BONJOUR GROUP bonjourgroup.net | ๐ฎ๐ณ India | Other | Aug 16, 2026 |
| 9 | KT RESTAURANT ktr.co.th | ๐น๐ญ Thailand | Hospitality | Aug 16, 2026 |
| 10 | PIO PIO piopio.com.co | ๐จ๐ด Colombia | Retail & E-Commerce | Aug 16, 2026 |
| 11 | ALTAIR | ๐บ๐ธ United States | Technology | Aug 12, 2026 |
| 12 | CALICHE | ๐จ๐ฑ Chile | Energy & Utilities | Aug 12, 2026 |
| 13 | Camandona SA www.camandona.ch | ๐จ๐ญ Switzerland | โ | Aug 12, 2026 |
| 14 | CARIBE / SUBRA kalimancaribe.com | ๐จ๐ด Colombia | Other | Aug 12, 2026 |
| 15 | CDA centrodiagnosticocda.it | ๐ฎ๐น Italy | โ | Aug 12, 2026 |
| 16 | ETICOD | โ | โ | Aug 12, 2026 |
| 17 | Goccia S.p.A. www.joygioielli.com | ๐ฎ๐น Italy | Manufacturing | Aug 12, 2026 |
| 18 | GRUPO STARFOODS starfoods.pt | ๐ต๐น Portugal | Agriculture and Food Production | Aug 12, 2026 |
| 19 | SCHMITZ & NITTENWILM schmitz-nittenwilm.de | ๐ฉ๐ช Germany | Manufacturing | Aug 12, 2026 |
| 20 | SON-VIDEO Son-Video.com | ๐ซ๐ท France | Retail & E-Commerce | Aug 12, 2026 |
| 21 | UAB Biotecha | ๐ฑ๐น Lithuania | Healthcare | Aug 12, 2026 |
| 22 | WONDR DIAMONDS & D GEM MOUNT wondrdiamonds.com | ๐บ๐ธ United States | Retail & E-Commerce | Aug 12, 2026 |
Frequently Asked Questions
What is Majinahanashi ransomware?
Majinahanashi is a ransomware threat group that has claimed 22 victims since its first known activity in August 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
How many victims has Majinahanashi attacked?
Majinahanashi has claimed 22 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, Colombia, Italy, Spain.
Which countries does Majinahanashi target?
Majinahanashi has attacked organizations in 14 countries. The top targeted countries are: United States, Colombia, Italy, Spain.
Which industries does Majinahanashi target?
Majinahanashi most frequently targets the Other, Hospitality, Retail & E-Commerce sectors based on victim disclosures in our database.
Is Majinahanashi still active?
Majinahanashi's most recent victim disclosure in our database was on September 1, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.