Blacknevas ransomware

Who Blacknevas is

BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.

Recorded activity

Disclosures attributed to Blacknevas in this database run from August 2025 to October 2026, totalling 50 victims — 0.2% of everything tracked here. Blacknevas has listed victims in 19 countries in this database, most often United States, followed by India and Turkey. The sectors appearing most in its listings are Manufacturing, Consumer Services, Technology.

Indicators of compromise

• 623f3e98908962669e48edd414dbb67e9d4e204f677998fdcc9c2d790816a67f
• 713392f009bc133f24b3271379a4ac147e1a7782b6a1ac957c1fda69d676b550
• 840b1c580bfd15ca3eb1cc94cf479f63b93285d2599bc2e3cd361e3f5a340f19
• 8a2d6d27ffcc66400a640d3c9c9e6becb90c04c5bab452cac56f999c48a04d63
• 910cc03d64bf09f53cdf3b83068cc46368c23a061c2e1ed5df0e3a35d6c9e084
• 95e744ddcc2e8f89f6c6e25503eff2eb5e70e98f6989bb4a4e93f17b09448e78

Showing a sample of 27 SHA256 on file. Hashes and network indicators published for Blacknevas. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
blacknevas ransomware
*/

rule blacknevas_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.blacknevas"
        description = "Detects blacknevas ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "blacknevas" ascii nocase
        $name2 = "BLACKNEVAS" ascii
        $onion  = "blacknevas.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Blacknevas, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.