blacknevas
Also known as: Trial RecoveryFirst seen August 6, 2025Active48 claimed victims
The claims below are reproduced as posted by blacknevas on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Amity University Dubai | September 17, 2026 | ransomware_live | — |
| Optimum First Mortgage (Pear's acting group's promotional blog) | September 16, 2026 | ransomware_live | — |
| Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco... | August 25, 2026 | ransomware_live | — |
| Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... | August 13, 2026 | ransomware_live | — |
| COMPUTER COUNTRY AND NETWORKS | August 12, 2026 | ransomware_live | — |
| Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT ... | August 12, 2026 | ransomware_live | — |
| Enteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co... | August 12, 2026 | ransomware_live | — |
| Westbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C... | August 12, 2026 | ransomware_live | — |
| ASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. | August 7, 2026 | ransomware_live | — |
| OTEGROUP | August 1, 2026 | ransomware_live | — |
| Speed Group | July 28, 2026 | ransomware_live | — |
| Zuni Shopping Center, Inc. | July 22, 2026 | ransomware_live | — |
| L'azurde | July 14, 2026 | ransomware_live | — |
| Arkin Group | June 30, 2026 | ransomware_live | — |
| Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach | June 30, 2026 | ransomware_live | — |
| Abans Finserv | June 29, 2026 | ransomware_live | — |
| Abans Group | June 29, 2026 | ransomware_live | — |
| Bohmler Einrichtungshaus GmbH | April 13, 2026 | ransomware_live | — |
| Carrera Casting Corp. | March 21, 2026 | ransomware_live | — |
| Heng An Standard Life Insurance | March 21, 2026 | ransomware_live | — |
| E-CON Packaging Private Limited | March 21, 2026 | ransomware_live | — |
| The company MST (Sanko Makina and ASKO Holding) | March 17, 2026 | ransomware_live | — |
| Applied LNG | December 22, 2025 | ransomware_live | — |
| Paramount Health Services & Insurance TPA Pvt. Ltd | November 20, 2025 | ransomware_live | — |
| Trojan Construction & Holding Group | October 21, 2025 | ransomware_live | — |
| LATCOM | October 19, 2025 | ransomware_live | — |
| Undefasa | October 9, 2025 | ransomware_live | — |
| Caresoft Global caresoftglobal.com | September 29, 2025 | ransomware_live | — |
| T. Choithram And Sons, LLC | September 29, 2025 | ransomware_live | — |
| CARTONAJES BERNABEU SAU www.cartonajesbernabeu.com serviced by IT company Verne Group www.... | September 9, 2025 | ransomware_live | — |
| OftalTech Solutions oftaltech.com | September 6, 2025 | ransomware_live | — |
| SISTRAN Consultores | September 1, 2025 | ransomware_live | — |
| TOYOTA ASIA TOYOTA INDIA | August 21, 2025 | ransomware_live | — |
| TANI & ABE | July 27, 2025 | ransomware_live | — |
| CHABAA BANGKOK | July 22, 2025 | ransomware_live | — |
| Dragonfly CO. LTD dragonflygame.com | July 7, 2025 | ransomware_live | — |
| CILI | July 2, 2025 | ransomware_live | — |
| KINAS SOLICITORS kinas.co.uk | June 9, 2025 | ransomware_live | — |
| KINAS SOLICITORS | June 9, 2025 | ransomware_live | — |
| Cash and carry - COSAEN GRUP | May 30, 2025 | ransomware_live | — |
| Payme Ltd | May 24, 2025 | ransomware_live | — |
| Quality Data Service, Inc. | May 21, 2025 | ransomware_live | — |
| LEARN is a Regional Educational Service Center | May 21, 2025 | ransomware_live | — |
| PROMOSFERA S.r.l. promosfera.com | May 19, 2025 | ransomware_live | — |
| PROMOSFERA S.R.l. | May 19, 2025 | ransomware_live | — |
| CLEARSYNTH LABS LIMITED | May 8, 2025 | ransomware_live | — |
| CK Power Public Company Limited | November 20, 2024 | ransomware_live | — |
| Yateem Group | April 24, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).