black nevas
Active16 claimed victims
The claims below are reproduced as posted by black nevas on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
BlackNevas ransomware — also referred to as “Trial Recovery” — was first observed in November 2024. It is a direct derivative of the Trigona ransomware family and continues the lineage's focus on extortion over public shaming. BlackNevas operators support a double-extortion model, encrypting files using AES-256 with RSA-4112-protected keys, and appending the .-encrypted or .ENCRYPTED file extension to affected files. Hybrid payloads are available for Windows, Linux, NAS, and VMware ESXi platforms.
Description from RansomLook (CC BY 4.0).
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Amity University Dubai | October 15, 2026 | ransomlook | — |
| Optimum First Mortgage (Pear's acting group's promotional blog) | September 17, 2026 | ransomlook | — |
| Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco | September 9, 2026 | ransomlook | — |
| Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer | September 9, 2026 | ransomlook | — |
| Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT | September 9, 2026 | ransomlook | — |
| Enteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co | September 9, 2026 | ransomlook | — |
| Westbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C | September 9, 2026 | ransomlook | — |
| COMPUTER COUNTRY AND NETWORKS | September 9, 2026 | ransomlook | — |
| ASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. www.emilcom.it | September 9, 2026 | ransomlook | — |
| OTEGROUP | September 9, 2026 | ransomlook | — |
| Speed Group | September 9, 2026 | ransomlook | — |
| L'azurde | September 9, 2026 | ransomlook | — |
| Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach | September 9, 2026 | ransomlook | — |
| Abans Group | September 9, 2026 | ransomlook | — |
| Cash and carry - COSAEN GRUP | September 9, 2026 | ransomlook | — |
| PROMOSFERA S.r.l. | September 9, 2026 | ransomlook | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).