Threat feed

Majinahanashi ransomware

Majinahanashi ransomware: green-dashboard evasion via WFP/QoS agent throttling, 14-second recovery kill, striped stealth encryption

Posted · Updated · Spectrum Delta Research Team

Summary

Majinahanashi is an actively-deployed ransomware operation (Japanese-branded, unattributed; first victim listing June 2026, ~32 tracked victims, most recent Oct 23) analyzed from a live sample by Cynet CyOps (Oct 21, A/3). Its encryptor is built for speed and invisibility: it throttles security agents to 'nothing' via Windows Filtering Platform rules and QoS policies so the agent stays green on the host while cut off from its cloud, fires a twice-run 14-second recovery-inhibition burst of directly-spawned Windows utilities, and encrypts in stripes at lowered disk priority to stay under behavioral-detection thresholds.

Breakdown

Adversary

Majinahanashi — unattributed

Procedures (3)

  1. WFP/QoS throttling cuts security agents from their cloud

    Impair defenses: quiet agent-cloud throttling via WFP rules and QoS policies

    • T1562.001

    Logs

    • Windows WFP / host firewall · Provider 'majinahanashi WFP'; QoS policy changes; agent-cloud egress death
    • Windows EDR / Sysmon process+file · Direct-spawned utilities; security process kills; .MAJIN writes

    Detectors

    No known detector

Click to expand remaining (2) procedures

  1. Twice-run 14-second recovery-inhibition utility burst

    Inhibit system recovery: seven utilities, ten commands, run twice, ~14 seconds

    • T1490Inhibit System Recovery

    Logs

    • Windows EDR / Sysmon process+file · Direct-spawned utilities; security process kills; .MAJIN writes
    • Windows Event Log · EventID 1102 Security log clearing

    Detectors

    No known detector

  2. Striped, priority-managed stealth encryption

    Data encrypted for impact: striped, tuned, low-priority encryption

    • T1486Data Encrypted for Impact

    Logs

    • Windows EDR / Sysmon process+file · Direct-spawned utilities; security process kills; .MAJIN writes

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Cynet (https://www.cynet.com/blog/majinahanashi-ransomware-analysis/), A/3; The Raven File (https://theravenfile.com/2026/08/14/majinahanashi-ransomware-another-japanese-locker/), B/3) — WFP filtering provider name 'majinahanashi WFP' (should never be present on a healthy machine); file extension .MAJIN; ransom note README.txt; mutex Global\majinahanashi_Mutex; encryption marker ENCRYPTEDAES256!SCT2; service name majinSvc; command line '--service --nolan'; 64-bit Windows PE built July 2, 2026 (~90KB, import table of 27 functions, ~200 functions across 14 libraries resolved at runtime); recovery-inhibition commands vssadmin delete shadows /all /quiet, bcdedit (recoveryenabled no / bootstatuspolicy ignoreallfailures), reagentc, powercfg /hibernate off, wevtutil, fsutil usn deletejournal; contact via qTOX and ProtonMail with per-victim case IDs; leak site headline 'OOPS. YOUR FILES LEAKED' with 魔人 branding. No file hashes published in the primary. Assessed 2026-10-24, hunt-only — the service name, mutex and marker are durable named-tool artifacts; the durable hunt value is the behavioral chain (WFP/QoS throttling, direct-spawned utility burst, striped low-priority encryption, operator console switches).

Detailed

Service: majinSvc. Mutex: Global\majinahanashi_Mutex. Encryption marker: ENCRYPTEDAES256!SCT2. WFP provider: 'majinahanashi WFP'. Command line: '--service --nolan'. Extension: .MAJIN (files keep original size). Note: README.txt, lock screen 'SEIZED' / 'THIS DEVICE HAS BEEN LOCKED.'. Wallpaper strings: Control Panel\Desktop / Wallpaper, Segoe UI font. Recovery-inhibition commands: vssadmin delete shadows /all /quiet; bcdedit recoveryenabled no; bcdedit bootstatuspolicy ignoreallfailures; reagentc.exe; powercfg /hibernate off; wevtutil; fsutil usn deletejournal. Binary: 64-bit PE, built 2026-07-02, ~90KB, 27 imported functions, ~200 functions across 14 libraries resolved at runtime, direct syscalls for file I/O, 17 command-line switches (--dry-run, --discover, --spread and three unnamed dev switches; printed with a typographic en dash in the primary — exact CLI syntax unverified), CIS-locale exit. Contact: qTOX, ProtonMail, per-victim case IDs. Leak site: Tor, nginx + Python/Flask, 'OOPS. YOUR FILES LEAKED' with 魔人 branding, victim archives in the victim's own folder structure. Sources: primary (Cynet (https://www.cynet.com/blog/majinahanashi-ransomware-analysis/), A/3, Oct 21 2026); community disassembly cross-verification (The Raven File (https://theravenfile.com/2026/08/14/majinahanashi-ransomware-another-japanese-locker/), B/3, Aug 14 2026). Assessed 2026-10-24, hunt-only. No file hashes published in either source.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Majinahanashi ransomware? Bring them to the community.

Discuss in the Tradecraft Slack