blacknevas
Known ransomware group ACTIVE Currently active
BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.
2
Total Claims
1
Critical
—
Records Claimed
2
Industries Hit
Active span: Sep 16, 2026 – Sep 17, 2026 · 2 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: Sep 2026 (2)Sep 2026
LessMore
Sep 2026Share this profile
Top Targeted Industries
Education 1
Financial Services 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
1
Known leak sites
Targeted Organizations
Claims by blacknevas
Low
Ransomware Claim: Amity University Dubai
Amity University Dubai
blacknevas
Ransomware Education
Oct 15, 2026 Critical
9.3 TB leaked Ransomware Claim: Optimum First Mortgage (Pear's acting group's promotional blog)
Optimum First Mortgage (Pear's acting group's promotional blog)
blacknevas
Ransomware Financial Services
Sep 17, 2026