blacknevas
Active since 2023-04-24
Unverified threat-actor claim — not a regulatory filing
Attribution, victim identity, and counts shown here derive from blacknevas's public extortion-blog claims, aggregated by ransomware.live. They have not been validated by the victim or any regulator. Treat them as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
According to ransomware.live, the group claims:
BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.
Source: Ransomware.live