Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
BlackNevas
As of Oct 19, 2026, BlackNevas has listed 45 confirmed victims on its leak site since Nov 20, 2024, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (20.0% of its victims) and its most targeted sector is Manufacturing.
BlackNevas is a ransomware group first observed in November 2024, believed to be derived from the Trigona ransomware family, targeting telecommunications, manufacturing, medical, and legal industries primarily in Asia-Pacific, the UK, Italy, and Lithuania using double-extortion with a dual AES/RSA encryption scheme.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 45
- Rank By Victims
- #109
- Last Leak-Site Post
- Sep 17, 2026
- Top Country
- United States
- Top Sector
- Manufacturing
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 2 |
| July 2026 | 3 |
| August 2026 | 8 |
| September 2026 | 1 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 1 |
| December 2025 | 1 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 4 |
| April 2026 | 1 |
| May 2026 | 0 |
| June 2026 | 2 |
| July 2026 | 3 |
| August 2026 | 8 |
| September 2026 | 1 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2024 | 1 |
| December 2024 | 0 |
| January 2025 | 0 |
| February 2025 | 0 |
| March 2025 | 0 |
| April 2025 | 0 |
| May 2025 | 8 |
| June 2025 | 1 |
| July 2025 | 4 |
| August 2025 | 1 |
| September 2025 | 5 |
| October 2025 | 4 |
| November 2025 | 1 |
| December 2025 | 1 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 4 |
| April 2026 | 1 |
| May 2026 | 0 |
| June 2026 | 2 |
| July 2026 | 3 |
| August 2026 | 8 |
| September 2026 | 1 |
| October 2026 (month in progress) | 0 |
Latest BlackNevas Victims.
Search all 45 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Amity University Dubai amityuniversity.ae | AEUnited Arab Emirates | Education and Research | Not stated | |
| Mefa Group / MEFA Endüstri / and (Efachem, Eco... mefagroup.com.tr | TRTürkiye | Manufacturing | Not stated | |
| Portable Intelligence Inc serviced by an IT company Computer... portable-intelligence.com | CACanada | Technology | Not stated | |
| Jack Rutherford Customs Brokers Ltd / The Rutherford Group serviced by an IT ... therg.ca | CACanada | Consulting | Not stated | |
| Enteroptyx Ophthalmology Products serviced by an IT company Computer Co... enteroptyx.com | USUnited States | Healthcare | Not stated | |
| Westbrook Greenhouse Systems serviced by an IT company Computer C... westbrooksystems.com | CACanada | Agriculture | Not stated |
How They Operate.
BlackNevas's threat actor profile lists 2 ATT&CK techniques, 14 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who BlackNevas Targets.
Sectors
History.
First confirmed victim listed on its leak site
Busiest month on record: 8 confirmed victims
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.