MAJINAHANASHI Ransomware Gang: 5 Victims in 48 Hours — Cross-Sector Leak Activity, Likely Edge-CVE Access Paths & Detection Rules

Brief date: 2026-08-13
Source: ransomware.live aggregation of MAJINAHANASHI .onion leak site postings; CISA KEV mapping for confirmed ransomware-abused CVEs.
Confidence: High on observed leak-site victim metadata; Medium on attribution of specific CVEs to MAJINAHANASHI intrusion chains until victim-level forensics confirm.

Executive Assessment

MAJINAHANASHI's leak site shows a short, concentrated posting burst: five victims published between 2026-08-11 and 2026-08-12, spanning Technology, Healthcare, Energy & Utilities, and uncategorized/Not Found entities across United States, Lithuania, Chile, and Switzerland. The cadence — multiple same-day disclosures rather than a slow drip — is consistent with an affiliate-driven operation clearing a queue of already-negotiated or already-exfiltrated victims, or an operator attempting to pressure several non-paying organizations simultaneously.

The sector mix is operationally meaningful: healthcare and energy/utilities carry high downtime sensitivity and regulatory leverage; technology victims can provide supply-chain adjacency; the two "Not Found" victims may be smaller regional firms or entities whose sector classification was not resolved by the aggregator. Defenders should treat this as a multi-sector extortion campaign with likely edge-device and remote-access initial access, not as proof of a single zero-day.

The adjacent CISA KEV set is important for prioritization even where victim-specific root cause is unknown: Check Point IKEv1 improper authentication (CVE-2026-50751), ConnectWise ScreenConnect path traversal/RCE (CVE-2024-1708), Microsoft Exchange deserialization (CVE-2023-21529), Cisco FMC/SCC deserialization (CVE-2026-20131), and Nx Console embedded malicious code (CVE-2026-48027) represent a practical access menu: perimeter VPN/auth bypass, MSP/RMM takeover, mail/server lateral foothold, firewall-management plane compromise, and developer-tool supply-chain execution.

1. Threat Actor Profile — MAJINAHANASHI

Attribution caveat: Public reporting on MAJINAHANASHI remains limited compared with long-running brands. The profile below separates observed leak-site facts from assessed behavior typical of similar mid-tier ransomware operations. Treat unverified items as hypotheses for hunting, not established doctrine.

Operational note: the name pattern and low public footprint warrant caution against over-attribution. Track infrastructure, leak-site HTML artifacts, ransom-note strings, payment addresses, negotiation-chat TTPs, and payload hashes before linking to known families.

2. Current Campaign Analysis

Observed victims

Sector targeting

• Technology: ALTAIR creates downstream risk if build systems, source repositories, managed services, or customer-facing hosted platforms were reachable.
• Healthcare: UAB Biotecha raises concerns around PHI/PII, lab systems, regulated records, and operational continuity; EU-adjacent breach obligations may apply depending on data subjects.
• Energy & Utilities: CALICHE is the highest-consequence listing. Even if IT-only, utility branding attracts regulatory scrutiny and increases the chance of OT-adjacent reconnaissance claims.
• Not Found: ETICOD and Camandona SA should not be dismissed; unresolved classification often maps to smaller regional services firms, manufacturing suppliers, or holding entities with weaker telemetry.

Geographic concentration

No single-country concentration. The spread — US, Lithuania, Chile, Switzerland — suggests opportunistic access acquisition rather than a geographically focused espionage campaign. This pattern is typical when access brokers sell validated VPN/RDP/RMM footholds across regions and the operator extorts whoever is monetizable.

Victim profile and revenue estimate

Precise revenue cannot be derived from the dataset. Based on sector norms:

• Technology and Swiss/EU entities: likely mid-market to enterprise, roughly $10M–$500M revenue unless confirmed otherwise.
• Healthcare/biotech: often IP-rich and regulation-heavy, with high extortion leverage even at modest revenue.
• Chilean energy/utilities: potentially strategic infrastructure with high downtime cost and strong government interest.
• Unknown-sector victims: assume SMB to mid-market, possibly $1M–$100M revenue, with limited segmentation and outsourced IT.

Posting frequency / escalation pattern

Four postings on 2026-08-12 after one on 2026-08-11 indicate a burst disclosure pattern. Interpretations:

1. Negotiation deadlines expired in parallel.
2. Affiliates delivered multiple access packages in the same window.
3. The crew is testing brand visibility with a rapid multi-victim release.
4. A shared access vector or access broker batch enabled several intrusions close together.

Escalation indicators to watch next: republication with "FULL DATA" labels, sample archives, employee/customer PII snippets, DDoS threats, media outreach, victim-domain typo leaks, and countdown timer resets.

CVE linkage to likely initial access

These CVEs are not confirmed as MAJINAHANASHI's vector for the listed victims; they are confirmed ransomware-abused KEV items that match the access surfaces defenders should inspect immediately:

• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1: prioritize remote-access/VPN logs, IKEv1 aggressive mode anomalies, unexpected admin/session creation, and gateway configuration exports.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal/RCE: hunt for unauthorized ScreenConnect instances, unexpected ScreenConnect.ClientService/ScreenConnect.Service execution, new extensions, and MSP-tool persistence.
• CVE-2023-21529 — Microsoft Exchange deserialization: look for webshells, w3wp.exe spawning command shells, suspicious EWS/OWA access, and mailbox/export anomalies.
• CVE-2026-20131 — Cisco FMC/SCC deserialization: review management-plane logins, API tokens, policy deployments, and unexpected FMC-initiated connections to sensors or internet hosts.
• CVE-2026-48027 — Nx Console embedded malicious code: relevant for technology victims and developer estates; audit extension/update provenance, build runners, npm/postinstall execution, and CI secrets exposure.

3. Detection Engineering

The rules below target behaviors repeatedly seen in ransomware intrusions involving edge access, RMM abuse, lateral movement, and pre-encryption staging. Tune thresholds to environment baselines.

---
title: MAJINAHANASHI - Suspicious Edge VPN Auth Followed by RDP or Admin Logon
id: 7a2c7f10-9a3b-4a7e-9f61-majin0001
status: experimental
description: Detects successful VPN/edge authentication anomalies followed within a short window by RDP, SMB admin share, or privileged logon activity consistent with ransomware initial access via exploited gateways.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Threat Intel
date: 2026/08/13
modified: 2026/08/13
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
  - attack.t1021.001
logsource:
  category: authentication
  product: windows
  service: security
detection:
  selection_logon:
    EventID:
      - 4624
      - 4625
    LogonType:
      - 3
      - 10
  selection_rdp_or_admin:
    EventID: 4624
    LogonType:
      - 10
      - 2
    TargetUserName|contains:
      - 'admin'
      - 'svc'
      - 'backup'
  filter_known_jump:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_logon and selection_rdp_or_admin and not filter_known_jump
timeframe: 15m
falsepositives:
  - Legitimate remote administration from approved jump hosts
  - VPN reconnect storms during outages
level: high
---
title: MAJINAHANASHI - RMM or Remote Access Tool Execution Outside Approved Inventory
id: 7a2c7f10-9a3b-4a7e-9f61-majin0002
status: experimental
description: Flags execution or service creation for remote monitoring/remote access tooling often abused by ransomware affiliates, including ScreenConnect-style services and portable remote desktop binaries.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Threat Intel
date: 2026/08/13
modified: 2026/08/13
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\rustdesk.exe'
      - '\splashtop.exe'
      - '\aeroadmin.exe'
      - '\ngrok.exe'
      - '\chisel.exe'
  selection_cmd:
    CommandLine|contains:
      - 'ScreenConnect'
      - 'relay='
      - '--password'
      - 'anydesk'
      - 'rustdesk'
      - 'support.me'
  filter_approved_rmm:
    Image|startswith:
      - 'C:\Program Files\ApprovedRMM\'
    CommandLine|contains:
      - 'approved-rmm-tenant'
  condition: (selection_img or selection_cmd) and not filter_approved_rmm
falsepositives:
  - Help desk remote support tools not yet in allowlist
  - Software packaging systems using remote deployment
level: high
---
title: MAJINAHANASHI - Pre-Encryption Staging, Shadow Copy Tampering, and Mass Archive Creation
id: 7a2c7f10-9a3b-4a7e-9f61-majin0003
status: experimental
description: Detects common pre-detonation behaviors: VSS deletion, boot configuration tampering, backup service manipulation, suspicious archive creation in staging directories, and security tool disabling.
author: Security Arsenal Threat Intel
date: 2026/08/13
modified: 2026/08/13
tags:
  - attack.impact
  - attack.t1490
  - attack.t1562.001
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'bcdedit /set'
      - 'recoveryenabled no'
      - 'wbadmin delete catalog'
      - 'Get-WmiObject Win32_ShadowCopy'
      - 'Remove-CimInstance'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip.exe'
      - '\tar.exe'
      - '\robocopy.exe'
    CommandLine|contains:
      - ' a -r '
      - ' a -m5 '
      - ' -p'
      - '\\staging\\'
      - '\\programdata\\'
      - '/MIR'
      - '/COPYALL'
  selection_defender:
    CommandLine|contains:
      - 'Set-MpPreference -DisableRealtimeMonitoring $true'
      - 'Add-MpPreference -ExclusionPath'
      - 'sc stop WinDefend'
      - 'DisableAntiSpyware'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators running approved maintenance
  - Enterprise packaging tools compressing payloads
level: critical

// Microsoft Sentinel: hunt for ransomware pre-detonation staging and lateral movement
// Focus: edge-auth anomalies, RMM execution, VSS tampering, archive staging, rare admin tool use
let Lookback = 14d;
let ApprovedRMM = dynamic(["ScreenConnect.ClientService.exe","TeamViewer.exe","AnyDesk.exe"]); // replace with approved inventory
let AdminTools = dynamic(["psexec.exe","wmic.exe","winrs.exe","schtasks.exe","at.exe","sc.exe","net.exe","nltest.exe","adfind.exe","csvde.exe","ldifde.exe"]);
let RareHostThreshold = 3;
let SignIn =
    SigninLogs
    | where TimeGenerated >= ago(Lookback)
    | where ResultType == 0
    | where AppDisplayName has_any ("VPN","Check Point","Cisco","Remote Access") or IPAddress !startswith "10."
    | summarize FirstVPN=min(TimeGenerated), LastVPN=max(TimeGenerated), VPNCount=count(), Apps=make_set(AppDisplayName), IPs=make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, 15m);
let SuspiciousProc =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where FileName in~ (AdminTools)
       or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","wbadmin delete catalog","DisableRealtimeMonitoring","Add-MpPreference -ExclusionPath","rar.exe a -r","7z.exe a -m","robocopy /MIR","/COPYALL")
       or (FileName in~ (ApprovedRMM) and InitiatingProcessFileName !in~ ("msiexec.exe","sccm.exe","IntuneManagementExtension.exe"))
    | extend IsVSS = ProcessCommandLine has_any ("delete shadows","shadowcopy","recoveryenabled no","wbadmin delete catalog")
    | extend IsArchive = ProcessCommandLine has_any ("rar.exe","7z.exe","/MIR","/COPYALL"," -p")
    | extend IsRMM = FileName in~ (ApprovedRMM)
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Cmds=make_set(ProcessCommandLine, 20), Files=make_set(FileName, 20), Hosts=dcount(DeviceName), Devices=make_set(DeviceName, 25) by AccountName, bin(TimeGenerated, 1h);
let LateralRare =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where FileName in~ (AdminTools)
    | summarize ToolHosts=dcount(DeviceName), Devices=make_set(DeviceName,50), ExampleCmd=any(ProcessCommandLine) by FileName
    | where ToolHosts >= RareHostThreshold;
SuspiciousProc
| join kind=leftouter SignIn on $left.AccountName == $right.UserPrincipalName
| join kind=leftouter LateralRare on $left.FileName == $right.FileName
| where IsVSS or IsArchive or IsRMM or ToolHosts >= RareHostThreshold or VPNCount > 0
| extend RiskScore = (toint(IsVSS)*40) + (toint(IsArchive)*20) + (toint(IsRMM)*15) + (iff(ToolHosts>=RareHostThreshold,15,0)) + (iff(VPNCount>0,10,0))
| project TimeGenerated, AccountName, RiskScore, IsVSS, IsArchive, IsRMM, Cmds, Devices, VPNCount, IPs, Apps, ToolHosts, ExampleCmd
| order by RiskScore desc, TimeGenerated desc;

# Rapid triage: run from an elevated PowerShell session on suspected Windows hosts or via approved EDR remote shell.
# Collects exposed RDP signs, new services/tasks, VSS state, suspicious archives, and RMM persistence from the last 7 days.
$ErrorActionPreference = 'SilentlyContinue'
$Out = "$env:ProgramData\SecArsenal_Majin_Triage_$(Get-Date -Format yyyyMMdd_HHmmss).json"
$since = (Get-Date).AddDays(-7)
$result = [ordered]@{}

$result.Host = $env:COMPUTERNAME
$result.CollectedUtc = (Get-Date).ToUniversalTime()
$result.RdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections -eq 0
$result.RdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber).PortNumber
$result.RecentLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$since} |
  Select-Object TimeCreated, Id, @{n='User';e={$_.Properties[5].Value}}, @{n='LogonType';e={$_.Properties[8].Value}}, @{n='SourceIp';e={$_.Properties[18].Value}} |
  Where-Object {$_.LogonType -in 2,3,10} | Select-Object -First 200
$result.NewServices = Get-CimInstance Win32_Service | Where-Object {$_.InstallDate -ge $since} |
  Select-Object Name, DisplayName, PathName, StartMode, State, InstallDate
$result.RecentTasks = Get-ScheduledTask | Where-Object {$_.Date -ge $since} |
  Select-Object TaskName, TaskPath, State, Date, @{n='Action';e={($_.Actions | Select-Object -First 1).Execute + ' ' + ($_.Actions | Select-Object -First 1).Arguments}}
$result.ShadowCopies = Get-CimInstance Win32_ShadowCopy | Select-Object ID, InstallDate, VolumeName, @{n='SizeMB';e={[math]::Round(($_.UsedSpace/1MB),2)}}
$result.VssDeleteEvents = Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$since} |
  Where-Object {$_.Message -match 'shadow|vss|delete'} | Select-Object TimeCreated, Id, ProviderName, Message -First 50
$result.SuspiciousRmm = Get-Process | Where-Object {$_.Name -match 'screenconnect|anydesk|teamviewer|rustdesk|splashtop|ngrok|chisel'} |
  Select-Object Name, Id, Path, StartTime
$result.ArchiveTools = Get-CimInstance Win32_Process | Where-Object {$_.Name -match 'rar|7z|robocopy|tar'} |
  Select-Object ProcessId, Name, CommandLine, CreationDate
$result.RecentLargeArchives = Get-ChildItem 'C:\','D:\' -Recurse -Include *.zip,*.rar,*.7z,*.tar,*.gz -ErrorAction SilentlyContinue |
  Where-Object {$_.LastWriteTime -ge $since -and $_.Length -gt 100MB} |
  Select-Object FullName, Length, LastWriteTime -First 100

$result | ConvertTo-Json -Depth 6 | Out-File $Out -Encoding UTF8
Write-Output "WROTE $Out"

4. Incident Response Priorities Specific to This Playbook

T-minus detection checklist — before encryption fires

Treat the following as a same-shift checklist when any related KEV asset or odd remote-auth event exists:

• New or re-enabled inbound remote access: RDP exposed externally, unusual VPN country/ASN, impossible travel, or authentication from datacenter/VPS ranges.
• Check Point/Cisco/Exchange/RMM change windows with no ticket: admin creation, API token issuance, policy push, gateway debug enabled, certificate or IKE settings changed.
• Security-control weakening: Defender exclusions, service stops, EDR uninstall attempts, tamper-protection alerts, Windows Event Log service manipulation.
• Privilege expansion: sudden Domain Admin/Enterprise Admin additions, DCSync-like replication requests, krbtgt anomalies, new GPOs linked broadly.
• Lateral movement burst: PsExec/service control manager traffic, WMI process creation, WinRM enablement, admin$ writes, rare net use, nltest, AdFind, BloodHound/SharpHound artifacts.
• Data staging: compressed archives in ProgramData, user temp, recyclers, web roots; cloud sync tools not in baseline; large outbound transfers to Mega/Backblaze/Dropbox/anonymous VPS; FTP/SFTP to rare destinations.
• Backup interference: shadow copy deletion, backup catalog deletion, backup job failures clustered, immutability policy changed, snapshot lifecycle shortened.

Critical assets this gang likely prioritizes for exfiltration

Based on current victims and double-extortion economics:

• Healthcare: EHR exports, lab results, patient identity documents, claims/billing, research data, clinical trial files, HR and credential stores.
• Energy/utilities: network diagrams, SCADA/OT-adjacent documentation even if not compromised, vendor contracts, substation/asset inventories, incident plans, engineering files, employee directories.
• Technology: source code, signing keys, CI/CD secrets, customer lists, support tickets with credentials, cloud IAM exports, build artifacts and release pipelines.
• Cross-sector: finance/ARP data, insurance policies, legal contracts, executive mailboxes, VPN/AD dumps, password vault exports, backup catalogs, and anything proving access depth for negotiation leverage.

Containment actions ordered by urgency

1. Isolate identity and management planes first: disable suspected sessions/tokens, force admin password rotation, revoke VPN/RMM/Exchange/FMC tokens, block new device enrollment.
2. Cut egress for staging: temporarily restrict outbound to only approved destinations for servers and admin subnets; preserve proxy/firewall logs before blocking if legal allows.
3. Quarantine affected edge assets: Check Point, Cisco FMC/SCC, Exchange, ScreenConnect/RMM servers; snapshot before reboot; capture volatile memory where feasible.
4. Protect backups: verify immutability, rotate backup credentials, isolate backup networks, export configuration, and test one critical restore before detonation risk rises.
5. Disable unauthorized remote tooling: remove rogue RMM agents and services; do not merely kill processes if persistence services/tasks remain.
6. Segment high-value sectors: healthcare clinical systems, utility operations support networks, source/build systems; deny server-to-server lateral protocols by default.
7. Preserve negotiation and leak evidence: capture leak-site HTML via approved threat-intel processes, ransom notes, onion URLs, file samples, timer state, wallet addresses, and victim-specific proof files.
8. Prepare regulated notification path: healthcare/EU/energy victims may trigger GDPR/HIPAA/state/utility-sector obligations; engage counsel early.

5. Hardening Recommendations

Immediate — next 24 hours

• Patch or mitigate the listed KEV exposures where present: Check Point CVE-2026-50751, ScreenConnect CVE-2024-1708, Exchange CVE-2023-21529, Cisco FMC/SCC CVE-2026-20131, and audit developer endpoints for Nx Console compromise tied to CVE-2026-48027.
• Enforce MFA on VPN, RMM, Exchange OWA/EWS/admin, firewall management, backup consoles, and cloud storage; block IKEv1 aggressive-mode legacy paths where feasible.
• Disable or restrict inbound RDP; require VPN plus device compliance and just-in-time admin; alert on LogonType 10 from non-corporate ASNs.
• Inventory all remote access tools and remove anything not on an approved list; alert on installation, service creation, and outbound beaconing for unapproved RMM.
• Lock down VSS and backup deletion: require protected admin groups, alert on vssadmin delete shadows, bcdedit, wbadmin delete catalog, backup catalog changes, and immutable snapshot policy edits.
• Deploy the Sigma/KQL logic above; create high-severity correlation when edge-auth anomaly is followed by admin logon, archive creation, or shadow-copy tampering within 60 minutes.
• Validate EDR tamper protection, sensor health coverage on servers and management appliances, and log forwarding from VPN/firewall/Exchange/RMM into SIEM.
• Reset credentials for any account with interactive logon to suspected infrastructure; prioritize service accounts with backup, RMM, domain join, or firewall-admin rights.

Short-term — within two weeks

• Move management planes for VPN, firewalls, Exchange, backups, and RMM into dedicated admin networks with phishing-resistant MFA and no direct internet exposure.
• Implement application allowlisting for servers and admin workstations; block unsigned archive/RMM/portable remote tools outside controlled directories.
• Adopt egress allowlisting for servers; deny common exfil destinations and newly seen cloud storage by default; require DLP or proxy inspection for large outbound flows.
• Separate backup identity from domain identity; enforce immutable/offline copies, dual-control deletion, and routine restore tests with forensic evidence capture.
• Harden identity: tiered administration, PAWs, gMSA where possible, Protected Users for sensitive admins, rapid krbtgt rotation procedure, and detection for replication/DCSync.
• Reduce developer supply-chain exposure: pin extension sources, verify package signatures, isolate CI runners, scan postinstall scripts, rotate CI secrets after any endpoint compromise.
• Build ransomware tabletop scenarios around this exact pattern: edge CVE -> RMM persistence -> data staging -> VSS deletion -> weekend encryption. Measure time-to-isolate and time-to-restore.
• Establish dark-web monitoring for victim naming, partial file trees, employee PII, and customer domains; define legal/PR/regulatory triggers before a posting occurs.

Analyst Bottom Line

MAJINAHANASHI's five-victim burst is small in volume but broad in consequence. The mix of healthcare, energy/utilities, technology, and unknown regional entities across four countries implies opportunistic monetization of valid access rather than tight targeting. Defenders should not wait for confirmation of a single exploit chain: assume edge VPN/auth weakness, RMM misuse, or mail/firewall management-plane compromise; hunt for staging and backup tampering immediately; and treat any KEV-exposed asset as a potential pre-ransomware beachhead.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub