Search threats, CVEs… ⌘K
← Back to all threat actors

blacknevas

BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-06-29
Last seen
2026-09-09
Sectors
manufacturing, professional-services, technology, retail-e-commerce, consumer-services, hospitality, healthcare, energy-utilities, transportation, business-services, other, agriculture-and-food-production
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimPROMOSFERA S.r.l. listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCash and carry - COSAEN GRUP listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAbans Group listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimArkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimL'azurde listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSpeed Group listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimOTEGROUP listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. www.emilcom.it listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCOMPUTER COUNTRY AND NETWORKS listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimWestbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimEnteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimJack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPortable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

Claimed
Victim claimMefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco... listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
RelationshipSame as relationship with black nevas

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

High
Claimed
Victim claimPortable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimJack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT ... listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEnteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co... listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimWestbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C... listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimCOMPUTER COUNTRY AND NETWORKS listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimOTEGROUP listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimSpeed Group listed by blacknevas

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 86 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

blacknevasCanonical Name

Shared-name reviews

Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.

Same actor high
blacknevas preferred black nevas

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

Same as: black nevas

Loading CVEs, techniques, indicators, malware, victims, and activity...