MAJINAHANASHI Ransomware Gang: 2 New Victims Posted — Campaign Analysis & Detection Engineering

---
title: Check Point VPN Improper Authentication Exploitation Attempt (CVE-2026-50751)
id: 8f3a2c1e-7b4d-4e9a-b2f1-9c6d5e4a3b21
status: experimental
description: Detects anomalous IKEv1 key exchange authentication events consistent with CVE-2026-50751 exploitation used as initial access by ransomware operators including MAJINAHANASHI
author: Security Arsenal Threat Intelligence
date: 2026/08/30
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: checkpoint
    service: vpn
detection:
    selection_auth_fail:
        action: 'key_exchange'
        ike_version: 'IKEv1'
        auth_result: 'failed'
    selection_anomaly:
        src_ip|cidr:
            - '0.0.0.0/0'
    filter_internal:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/8'
            - '192.168.0.0/16'
    condition: selection_auth_fail and selection_anomaly and not filter_internal
falsepositives:
    - Misconfigured remote clients
    - Legacy IKEv1 site-to-site tunnel negotiation
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1133
    - cve.2026.50751
---
title: Ransomware Pre-Encryption Staging - Volume Shadow Copy Deletion
id: 2b7d9e4f-1a3c-4d8b-9e2f-5c8a6b3d7e19
status: stable
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, or PowerShell - a near-universal pre-encryption step in ransomware playbooks including MAJINAHANASHI double-extortion operations
author: Security Arsenal Threat Intelligence
date: 2026/08/30
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Remove-WmiObject'
            - 'Get-WmiObject Win32_Shadowcopy'
            - 'Delete()'
    condition: 1 of selection_*
falsepositives:
    - Legitimate backup maintenance scripts
    - IT storage reclamation tasks
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.defense_evasion
---
title: PsExec or WMI Remote Execution - Ransomware Lateral Movement
id: 5c1e8a3d-9f2b-4a7c-8d1e-3b6f9a2c5d84
status: stable
description: Detects remote service creation via PsExec-named pipes or WMI process creation commonly used by ransomware affiliates for mass encryption deployment across domain assets
author: Security Arsenal Threat Intelligence
date: 2026/08/30
logsource:
    product: windows
    service: system
    definition: 'Event ID 7045 service installation'
detection:
    selection_event:
        EventID: 7045
    selection_psexec:
        ServiceName|contains:
            - 'PSEXESVC'
            - 'PAExec'
            - 'csexec'
    selection_suspicious_path:
        ImagePath|contains:
            - '\ADMIN$\'
            - '\Temp\'
            - '\Users\Public\'
        ImagePath|endswith: '.exe'
    condition: selection_event and (selection_psexec or selection_suspicious_path)
falsepositives:
    - Legitimate administrative remote management
    - Software deployment tools (SCCM, PDQ)
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002

// MAJINAHANASHI-style pre-encryption staging hunt
// Looks for: shadow copy tampering + mass file staging + suspicious outbound volume within 72h window
let lookback = 7d;
let staging_window = 72h;
// Signal 1: Shadow copy deletion / backup tampering
let ShadowTamper = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where ProcessCommandLine has_any ("vssadmin delete shadows", "shadowcopy delete", "resize shadowstorage", "bcdedit", "wbadmin delete")
| project ShadowTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine;
// Signal 2: Archive creation in user-writable dirs (data staging)
let Staging = DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where FolderPath has_any ("\\Users\\Public\\", "\\ProgramData\\", "\\Temp\\")
| where FileName endswith_any (".zip", ".rar", ".7z", ".tar.gz")
| project StageTime=TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessAccountName;
// Signal 3: Large outbound transfers to uncommon destinations (exfil)
let Exfil = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any ("mega.nz", "transfer.sh", "file.io", "anonfiles", "gofile.io", "temp.sh")
    or RemotePort in (21, 22, 443) and ActionType == "ConnectionSuccess" and InitiatingProcessName in~ ("rclone.exe", "megasync.exe", "winscp.exe", "filezilla.exe")
| project ExfilTime=TimeGenerated, DeviceName, InitiatingProcessName, RemoteUrl, RemoteIP, RemotePort;
// Correlate devices showing 2+ signals within the staging window
ShadowTamper
| join kind=inner Staging on DeviceName
| where datetime_diff('hour', StageTime, ShadowTime) between (0 .. 72)
| join kind=leftouter Exfil on DeviceName
| summarize FirstActivity=min(ShadowTime), LastActivity=max(ExfilTime), Signals=count(),
            Accounts=make_set(AccountName), StagedFiles=make_set(FileName), ExfilDestinations=make_set(RemoteUrl)
  by DeviceName
| sort by Signals desc, FirstActivity asc

# MAJINAHANASHI Rapid Triage Script - run on domain controllers and edge-facing servers
# Checks: RDP exposure, scheduled tasks (7d), shadow copy integrity, new local admins
# Requires: Run as Administrator

$report = @()
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== [1] RDP EXPOSURE CHECK ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
$rdpPort = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Measure-Object).Count
$report += [pscustomobject]@{Check="RDP_Enabled"; Risk=$(if($rdpEnabled){"HIGH"}else{"OK"}); Detail="fDenyTSConnections=$($rdpEnabled -eq $false)"}
$report += [pscustomobject]@{Check="NLA_Enforced"; Risk=$(if($rdpEnabled -and -not $nlaEnabled){"HIGH"}else{"OK"}); Detail="NLA=$nlaEnabled"}
$report += [pscustomobject]@{Check="RDP_Listening"; Risk=$(if($rdpPort -gt 0){"REVIEW"}else{"OK"}); Detail="Listeners=$rdpPort"}

Write-Host "=== [2] SCHEDULED TASKS (LAST 7 DAYS) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } | ForEach-Object {
    $report += [pscustomobject]@{Check="NewScheduledTask"; Risk="REVIEW"; Detail="$($_.TaskName) | $($_.TaskPath) | Created=$($_.Date)"}
}

Write-Host "=== [3] VOLUME SHADOW COPY INTEGRITY ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check="ShadowCopies"; Risk=$(if(-not $shadows){"CRITICAL - may indicate T1490 tampering"}else{"OK"}); Detail="Count=$(@($shadows).Count)"}

Write-Host "=== [4] NEW LOCAL ADMINISTRATORS (7d) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Administrators' } | ForEach-Object {
    $report += [pscustomobject]@{Check="AdminGroupChange"; Risk="HIGH"; Detail="$($_.TimeCreated) | $($_.Message.Substring(0,[Math]::Min(200,$_.Message.Length)))"}
}

Write-Host "=== [5] SUSPICIOUS RMM / EXFIL TOOLING ===" -ForegroundColor Cyan
$tools = @('rclone.exe','megasync.exe','winscp.exe','filezilla.exe','psexec.exe','screenconnect*.exe','anydesk.exe')
foreach ($t in $tools) {
    Get-ChildItem -Path C:\ -Recurse -Filter $t -ErrorAction SilentlyContinue -Depth 4 | ForEach-Object {
        $report += [pscustomobject]@{Check="SuspiciousTool"; Risk="REVIEW"; Detail=$_.FullName}
    }
}

$report | Sort-Object Risk | Format-Table -AutoSize
$report | Export-Csv -Path ".\MAJINAHANASHI_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Report exported. Investigate any CRITICAL/HIGH findings before assuming host is clean." -ForegroundColor Yellow