BlackNevas

BlackNevas (also referenced as 'Trial Recovery') was first detected in November 2024 and quickly spread across Asia, Europe and North America, hitting healthcare, finance, manufacturing, legal and telecom targets. Technically it is assessed as a variant of the Trigona ransomware family and supports Windows, Linux, NAS devices and VMware ESXi, combining AES-RSA encryption with data theft; encrypted files carry a distinctive '.-encrypted' extension and ransom notes direct victims to negotiate via email or Telegram.

Unlike most double-extortion crews, BlackNevas reportedly does not operate its own dedicated leak site; instead it is said to collaborate with other groups for data publication, with reported partners including Kill Security, Hunters International, DragonForce, Blackout, Embargo and Mad Liberator. Its extortion approach emphasizes negotiation and profit over public naming-and-shaming, with reported multi-million-dollar demands and short (around 7-day) payment deadlines for enterprise targets.

BlackNevas appears to operate independently rather than as a broad RaaS. Its MENA-relevant claims include Saudi Arabia and the UAE. Because it leans on partner channels for publication, victim claims may be harder to attribute and should be treated as unverified unless confirmed by a reputable source or the affected organization.