Threat Group Profile
blacknevas
● Active — last 30 days
Victim claims
4
First seen
Apr 2026
Last activity
30 Jun 2026
Tracked since
Aug 2025
Group overview
BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.
Preferred targets
Consumer Services · 3
Business Services · 1
Most targeted countries
LK · 1
IN · 1
DE · 1
