BlackNevas Ransomware Hits Firms With Data Theft Threat

The BlackNevas ransomware group has rapidly escalated its attacks since its emergence in November 2024, targeting businesses and critical infrastructure across Asia, North America, and Europe. BlackNevas ransomware hits firms with a dual threat: file encryption combined with data theft, followed by a seven-day ultimatum to pay or face public exposure of stolen information.

Roughly half of the group’s attacks have struck Asia-Pacific, with Japan, Thailand and South Korea among the hardest hit. In Europe, victims include organizations in the UK, Italy and Lithuania, while U.S. targets have been concentrated in Connecticut. BlackNevas ransomware hits firms through a custom-built malware strain that avoids the Ransomware-as-a-Service model, using its own leak site and affiliate pressure tactics to force payments.

The malware applies AES and RSA encryption, renames files with “.-encrypted” or “trial-recovery” tags, and blocks recovery by withholding private keys.

Read the full article at

BlackNevas Ransomware Encrypts Files and Steals Sensitive Data From Affected Companies