Ransomware Group intelligence
Majinahanashi
ActiveTrack Majinahanashi with 49 published victims and 7 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Majinahanashi is tracked by Dark Eye as a ransomware group with 49 published victims.
Italy is currently the most targeted country in this dataset.
7 known leak locations are currently associated with this group.
Leak Status Distribution
49
- Leaked 21 42.9%
- Pending 28 57.1%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (7)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 7 | Onion service | Up checked 1h ago | gmpxaidwv4cw7o2uvkrxpwnxk5esflzv2l3lm4lvpypu56bigr4n4nad.onion |
| Leak location 1 | Onion service | Up checked 1h ago | lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion |
| Leak location 6 | Onion service | Down checked 1h ago | iy5iikmqxercpdjk5swzib2m2f3sn6o3o7khivgul4f47nweflusqiqd.onion |
| Leak location 4 | Onion service | Down checked 1h ago | rz45lyi2ehl2e2xs3ivwbah65tumebztmypmtqpc6cigc3wadwjicgad.onion |
| Leak location 5 | Onion service | Down checked 1h ago | 4vr5sxshsx6se4qixnrvbqyikqtknfjhe4ybitp2zhjjzazm4ohawbid.onion |
| Leak location 3 | Onion service | Down checked 1h ago | rtypxnzdjus6slwtzhmnh7dnc35q3sdzbiuhaammefl5u2ce2lxkg5yd.onion |
| Leak location 2 | Onion service | Down checked 1h ago | cc666mzpsjhn3yi6t7hqkwi5thjeh7prxg3mndpceb7xtchsbsmct3ad.onion |
Top Activity Sectors (9)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Majinahanashi, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: majinahanashi executes PowerShell scripts to deploy payloads and manipulate system processes on targeted hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: majinahanashi modifies Windows Registry Run keys to maintain persistence across reboots on compromised systems.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: majinahanashi uses startup folders to launch ransomware components automatically during user logon.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: majinahanashi disables antivirus tools and modifies security utilities to evade detection during lateral movement.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: majinahanashi deletes Volume Shadow Copies and backup directories to prevent recovery from ransomware encryption.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: majinahanashi uses file and directory discovery to enumerate critical retail and agricultural data paths before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1560.001 Archive via Utility Collection
What they do: majinahanashi archives stolen retail transaction data using utility tools prior to exfiltration.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: majinahanashi encrypts victim files with impact-oriented payloads targeting e-commerce and healthcare databases.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: majinahanashi stops critical Windows services like backup and monitoring tools to maximize disruption.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: majinahanashi inhibits system recovery by corrupting backup services and disabling restore mechanisms.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (49)
Search, filter and paginate the victim timeline for Majinahanashi. Showing 1–49 of 49.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Bi-silque id35577 View details | United States | Other | leaked | ||
|
LEAK19 Oct 2026 Bi-silque A Portuguese manufacturing company that produces equipment for offices, schools, and presentations. Its product line includes whiteboards, corkboards, flip charts, information displays, glass board... |
||||||
| Ransomware | Albertin Alcide e Figli S.n.c. id35518 View details | Italy | Manufacturing / Engineering | leaked | ||
|
LEAK04 Oct 2026 Albertin Alcide e Figli S.n.c. Albertin Alcide e Figli S.n.c. manufactures plates, stamps, and printing forms for hot stamping, flexography, and printing. HQ: Via Casignolo 30, 20092 Cinisello Balsamo (MI) Phone: +39 02 66046256... |
||||||
| Ransomware | SA BAUFER V.F id35519 View details | Germany | Manufacturing / Engineering | leaked | ||
|
LEAK04 Oct 2026 SA BAUFER V.F SA BAUFER VF is a Swiss company that specializes in the processing, supply, and installation of reinforcing steel for reinforced concrete structures HQ: Via Industrie 14, 6512 Giubiasco, Switzerlan... |
||||||
| Ransomware | Tema Energy S.r.l. id35520 View details | Italy | Energy | leaked | ||
|
LEAK06 Oct 2026 Tema Energy S.r.l. Tema Energy S.r.l. manufactures and processes components and equipment for the oil and gas and power generation industries, including components for gas turbine and power generation systems. HQ: Vi... |
||||||
| Ransomware | Tema Energy S.r.l. id35554 View details | Italy | Energy | leaked | ||
|
LEAK06 Oct 2026 Tema Energy S.r.l. Tema Energy S.r.l. manufactures and processes components and equipment for the oil and gas and power generation industries, including components for gas turbine and power generation systems. HQ: Vi... |
||||||
| Ransomware | CFG SERRAMENTI S.r.l. id35521 View details | Italy | Manufacturing / Engineering | leaked | ||
|
LEAK07 Oct 2026 CFG SERRAMENTI S.r.l. CFG Serramenti S.r.l. is an Italian manufacturer and installer of windows, doors, and other window and door systems—primarily made of PVC—operating in Bergamo, Milan, and throughout Lombardy; the c... |
||||||
| Ransomware | i2r Packaging Solutions Limited id35522 View details | Singapore | Manufacturing / Engineering | leaked | ||
|
LEAK08 Oct 2026 i2r Packaging Solutions Limited i2r Packaging Solutions Limited manufactures aluminium packaging and containers for the food industry. HQ: Capital House, Hadley Park East, Telford, Shropshire, TF1 6QJ, UK Phone: +44 845 371 5111... |
||||||
| Ransomware | Robert Hitchins Limited id34946 View details | United Kingdom | Services | leaked | ||
|
LEAK08 Oct 2026 Robert Hitchins Limited It is a major private real estate development and investment company founded in the United Kingdom in 1958. The company specializes in land management, construction, and investments in commercial a... |
||||||
| Ransomware | PIO PIO id33674 View details | Colombia | Retail / E-commerce | pending | ||
|
Pio Pio (Grupo PIO PIO S.A.S.) is a family-owned rotisserie chicken restaurant chain (asadero) in Colombia. Currently 10+ locations in the Popayán/Cali region (southwestern Colombia). Managed by th... |
||||||
| Ransomware | BONJOUR GROUP id33675 View details | India | — | pending | ||
|
Bonjour Group (brand BONJOUR) is India's largest socks manufacturing company. Founded in 1988. Headquartered in Greater Noida, Uttar Pradesh, India. Legal entity: Bonjour Group (privately held) Fou... |
||||||
| Ransomware | KT RESTAURANT id33676 View details | — | — | pending | ||
|
KT Restaurant is a Thai restaurant operator, owner of the Santa Fe steakhouse chain in Bangkok, Thailand. The company was acquired by Boon Rawd Brewery (Singha Corporation) — one of Thailand's larg... |
||||||
| Ransomware | SON-VIDEO id33677 View details | France | Retail / E-commerce | pending | ||
|
Son-Video.com is France's largest online retailer of hi-fi and home-cinema equipment. Founded in 2000. Headquartered in Champigny-sur-Marne, Île-de-France. 17 physical stores across France (Paris,... |
||||||
| Ransomware | GRUPO STARFOODS id33678 View details | Portugal | Agriculture / Food | pending | ||
|
Grupo Starfoods is a Portuguese restaurant group founded in 1993. Headquartered in Cruz Quebrada, Lisbon. Owns 6 brands: Companhia, Loja das Sopas, Bifanas de Vendas Novas, Selfish, Basílico, and T... |
||||||
| Ransomware | CDA id33679 View details | — | Healthcare / Pharma | pending | ||
|
Internal domain: CDA.local. Servers encrypted. 100,000+ DICOM files extracted from medical imaging archive. Patient names, IDs, birth dates, study descriptions, and referring physicians are present... |
||||||
| Ransomware | WONDR DIAMONDS & D GEM MOUNT id33680 View details | India | Retail / E-commerce | pending | ||
|
- Tally Backups - CRM Backups Wondr Diamonds is a lab-grown diamond and fine jewelry retailer operating in the United States and India. Gem Mount (D Gem Mount) is an Indian diamond jewellery manufa... |
||||||
| Ransomware | CARIBE / SUBRA id33681 View details | — | Hospitality / Food & Beverage / Tourism | pending | ||
|
Internal domain: CARIBE.LOCAL. Servers & Hyper-V encrypted. 20.000+ sensitive H&R files extracted from storage servers. |
||||||
| Ransomware | SCHMITZ & NITTENWILM id33682 View details | Germany | Manufacturing / Engineering | pending | ||
|
Schmitz & Nittenwilm is a traditional family-owned bakery chain based in Köln (Cologne), Germany. Founded in the early 1930s. Currently operates 38 branches in Köln and Hürth. Third-generation fami... |
||||||
| Ransomware | Goccia S.p.A. id33683 View details | Italy | Retail / E-commerce | pending | ||
|
Goccia S.p.A. is a major Italian jewelry corporation headquartered in Cocconato, Piedmont, which owns the well-known retail chain and popular online store JOY Gioielli. The company is an official d... |
||||||
| Ransomware | Camandona SA id33684 View details | Switzerland | Retail / E-commerce | pending | ||
|
Camandona SA is a major Swiss construction and road-building company founded in 1948 and based in the French-speaking canton of Vaud. It specializes in asphalt paving, road construction, civil engi... |
||||||
| Ransomware | UAB Biotecha id33685 View details | Lithuania | Healthcare / Pharma | pending | ||
|
UAB Biotecha is a privately held Lithuanian company. It operates in the Baltic states and specializes in supplying equipment, technologies, and reagents for the life sciences, the pharmaceutical in... |
||||||
| Ransomware | ETICOD id33686 View details | Poland | Other | leaked | ||
|
Eticod is a family-run, prominent label printing house based in Katowice, Poland, founded in 1994. It specializes in self-adhesive labels, barcodes, thermal transfer ribbons, and advanced packaging... |
||||||
| Ransomware | CALICHE id33687 View details | Chile | Energy | leaked | ||
|
Grupo Caliche is a major Spanish corporation engaged in international logistics, freight transportation, and the provision of telecommunications services. The company coordinates the delivery of go... |
||||||
| Ransomware | Grand Ion Delemen Hotel id33688 View details | Türkiye | — | leaked | ||
|
The Grand Ion Delemen Hotel is a high-rise, five-star resort complex in Genting Highlands (Malaysia) that offers premium accommodations and a relaxing getaway in a cool mountain climate. HQ: Jalan... |
||||||
| Ransomware | The Margo Hotel id33689 View details | United Kingdom | — | leaked | ||
|
The Margo Hotel is a leading 4-star business hotel in Depok that offers premium service, modern facilities for large-scale conferences, and a comfortable stay, and regularly receives top ratings fr... |
||||||
| Ransomware | PCA Group Sdn. Bhd. id33690 View details | Malaysia | Services | leaked | ||
|
PCA Group is a Malaysian industrial, engineering, and manufacturing company founded in 1989 that designs, manufactures, installs, and maintains infrastructure and equipment for major international... |
||||||
| Ransomware | TERRACOM & MONTCAU id33691 View details | — | Services | leaked | ||
|
Montcau ERP SaaS is a Spanish cloud-based ERP and POS solution developed by Terrassenca de Telecomunicacions, SLU (Terracom), designed for the management of production, sales, retail operations, in... |
||||||
| Ransomware | HYSYTECH S.r.l. id33692 View details | Italy | — | leaked | ||
|
HYSYTECH S.r.l. is an Italian engineering and technology company that designs and builds industrial processing plants, specifically systems for the production and processing of hydrogen, biomethane... |
||||||
| Ransomware | TERRACOM & MONTCAU id32385 View details | Spain | Services | — | leaked | |
|
PUBLICATION SCHEDULED. [LEAK / 6341 FILES] |
||||||
| Ransomware | TERRA*** & MON**** id32258 View details | Spain | — | — | pending | |
|
PUBLICATION SCHEDULED. [LEAK / 6341 FILES] |
||||||
| Ransomware | MONTCAU id32257 View details | France | Services | — | leaked | |
|
PUBLICATION SCHEDULED. [LEAK / 6341 FILES] |
||||||
| Ransomware | PCA Group Sdn. Bhd. id32093 View details | Malaysia | Services | — | leaked | |
|
PUBLICATION SCHEDULED. [LEAK / 1844 FILES] |
||||||
| Ransomware | PCA ***** id32013 View details | — | — | pending | ||
|
PUBLICATION SCHEDULED. [LEAK / 1844 FILES] |
||||||
| Ransomware | Grand Ion Delemen Hotel id31862 View details | — | — | leaked | ||
|
PUBLICATION SCHEDULED. [LEAK / 5045 FILES] |
||||||
| Ransomware | The Margo Hotel id31863 View details | United Kingdom | — | leaked | ||
|
PUBLICATION SCHEDULED. [LEAK / 8080 FILES] |
||||||
| Ransomware | PIO PIO id31742 View details | Colombia | Retail / E-commerce | pending | ||
|
TARGET: piopio.com.co REVENUE: $5m EMPLOYEES: 33 staff [LEAK / 6306 FILES] |
||||||
| Ransomware | BONJOUR GROUP id31743 View details | India | — | pending | ||
|
TARGET: bonjourgroup.net, bonjourretail.com REVENUE: $57.8 Million EMPLOYEES: 501-1,000 employees [LEAK / 5620 FILES] |
||||||
| Ransomware | KT RESTAURANT id31744 View details | Thailand | — | pending | ||
|
TARGET: ktr.co.th REVENUE: ~$55M USD EMPLOYEES: ~ [LEAK / 1853 FILES] |
||||||
| Ransomware | SON-VIDEO id31585 View details | France | Retail / E-commerce | pending | ||
|
TARGET: Son-Video.com REVENUE: $54M EMPLOYEES: ~51-200 employees [LEAK / 10382 FILES] |
||||||
| Ransomware | GRUPO STARFOODS id31586 View details | Portugal | Agriculture / Food | — | pending | |
|
TARGET: starfoods.pt REVENUE: ~ EMPLOYEES: ~ [LEAK / 3420 FILES] |
||||||
| Ransomware | CDA id31587 View details | Italy | Healthcare / Pharma | — | pending | |
|
TARGET: https://centrodiagnosticocda.it/ REVENUE: ~ EMPLOYEES: ~ [LEAK / 135426 FILES] |
||||||
| Ransomware | WONDR DIAMONDS & D GEM MOUNT id31588 View details | United States | Retail / E-commerce | — | pending | |
|
TARGET: wondrdiamonds.com & gemmount.com REVENUE: $12m USD EMPLOYEES: 200+ [LEAK / 247 FILES] |
||||||
| Ransomware | CARIBE / SUBRA id31589 View details | Colombia | Hospitality / Food & Beverage / Tourism | — | pending | |
|
TARGET: kalimancaribe.com & subra.bg. REVENUE: ~ EMPLOYEES: ~ [LEAK / 21311 FILES] |
||||||
| Ransomware | SCHMITZ & NITTENWILM id31590 View details | Germany | Manufacturing / Engineering | — | pending | |
|
TARGET: schmitz-nittenwilm.de REVENUE: €13,8M EMPLOYEES: ~ [LEAK / 886 FILES] |
||||||
| Ransomware | Goccia S.p.A. id31591 View details | Italy | Retail / E-commerce | — | pending | |
|
TARGET: https://www.joygioielli.com/ https://www.gocciagioielli.com/ REVENUE: €19.2M EMPLOYEES: ~ [LEAK / 3557 FILES] |
||||||
| Ransomware | Camandona SA id31592 View details | Switzerland | Retail / E-commerce | — | pending | |
|
TARGET: https://www.camandona.ch/ REVENUE: $61.7M EMPLOYEES: 200 [LEAK / 9584 FILES] |
||||||
| Ransomware | ALTAIR id31593 View details | United States | IT | — | pending | |
|
PUBLICATION SCHEDULED. [LEAK / 84251 FILES] |
||||||
| Ransomware | UAB Biotecha id31594 View details | Lithuania | Healthcare / Pharma | — | pending | |
|
PUBLICATION SCHEDULED. [LEAK / 20888 FILES] |
||||||
| Ransomware | ETICOD id31595 View details | — | Other | — | pending | |
|
PUBLICATION SCHEDULED. [LEAK / 5730 FILES] |
||||||
| Ransomware | CALICHE id31596 View details | Chile | Energy | — | leaked | |
|
PUBLICATION SCHEDULED. [LEAK / 39200 FILES] |
||||||