MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker

This report outlines the discovery and initial analysis of the "Majinahanashi" ransomware group (active June–August 2026), covering its Tor-based data leak site and file servers, victim list (15 victims across multiple countries and sectors), ransom negotiations and bitcoin address, and a medium-depth technical analysis of samples showing AES-256 per-file encryption with RSA-wrapped keys, aggressive backup/restore disruption, EDR/process-killing behavior, Windows service persistence, WFP-based network controls, and defensive-evasion techniques; several IOCs (onion domains, dropped paths, mutex, service name) and a YARA rule are provided to support detection and monitoring.