Also known as: Trial Recovery
BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme. Known victims: 31
Objectives
Executive Summary
BlackNevas is a ransomware group first observed in April 2023, suspected to be derived from the Trigona family, targeting sectors like telecommunications and medical services primarily in亚太地区, the UK, Italy, and Lithuania. Known for double extortion using AES/RSA encryption, BlackNevas has successfully targeted over 31 organizations, highlighting their growing threat in the ransomware landscape.
Goals & Targeting
BlackNevas primarily seeks financial gain through ransomware activities. Their targeting strategy focuses on sectors with sensitive data, high recovery costs, and potential willingness to pay ransoms. Geographically, they concentrate on regions where organizations might have higher susceptibility or slower incident response, enhancing their campaign success rate.
Enhanced Description
BlackNevas emerged in April 2023 as a significant player in the ransomware ecosystem, evolving from the Trigona family. This group specializes in double extortion tactics, encrypting victims' data with a combination of AES and RSA encryption to increase pressure for payment. Targeting sectors such as telecommunications, manufacturing, medical, and legal services, BlackNevas has demonstrated a regional focus on Asia-Pacific countries, the UK, Italy, and Lithuania. Their operations include notable campaigns against entities like PROMOSFERA S.R.l., KINAS SOLICITORS, and Heng An Standard Life Insurance. The group's activities underscore advanced tactics aimed at maximizing financial gain through targeted extortion.
Key Capabilities
MITRE ATT&CK Tactics
Software / Tooling
Campaigns & Victims
BlackNevas has executed campaigns against various industries, with a focus on sectors offering high-value data. Their victims include prominent companies across Asia-Pacific and Europe. Notable campaigns involve targeting legal and healthcare firms, indicating strategic selection based on data sensitivity.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Confidence in BlackNevas' details is moderate. Data on their TTPs, linked MITRE techniques, and associated tools is limited, which hinders comprehensive analysis. Additional intelligence would improve understanding of their capabilities and modus operandi.
No techniques linked yet.
No tools linked yet.
No observed data linked yet.
No references recorded yet.
0
Techniques
0
Tools
17
Campaigns
27
IOCs
0
Observed Data
0
Tactics