THREAT ACTOR
BLACK-NEVAS_
DormantBLACK-NEVAS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BLACK-NEVAS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 25
- 2025 25
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onionDLS snapshot · 2026-09-23 02:00
Recent victims
The 50 most recent victims claimed by BLACK-NEVAS. Total in the index: 50.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-17 | Optimum First Mortgage (Pear's acting group's promotional blog) | |
| 2026-09-09 | PROMOSFERA S.r.l. | passports, employee and client documents, databases of promotional par… |
| 2026-09-09 | Cash and carry - COSAEN GRUP | Cash and carry - COSAEN GRUPProfessionals in the food sectorюCosaen Gr… |
| 2026-09-09 | Abans Group | The Abans Group is a globally diversified organization engaged in Inve… |
| 2026-09-09 | Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach | Arkın Group is a Turkish Cypriot company group primarily operating in … |
| 2026-09-09 | L'azurde | L'azurdeL'azurde Company for Jewelry is a prominent Middle Eastern jew… |
| 2026-09-09 | Speed Group | Speed Group (speedgroupe.com / speedfrance.fr) is a global leader in… |
| 2026-09-09 | OTEGROUP | OTE Group, founded in 1991, is one of Oman's leading business groups a… |
| 2026-09-09 | ASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. www.emilcom.it | ASCOM S.p.A. is an Italian manufacturer of heavy lifting equipment for… |
| 2026-09-09 | COMPUTER COUNTRY AND NETWORKS | A local Canadian IT company based in Stratford, Ontario, operating sin… |
| 2026-09-09 | Westbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C | A Canadian family-owned company (part of the Westbrook Group of Compan… |
| 2026-09-09 | Enteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co | There is very little public information available about this company. … |
| 2026-09-09 | Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT | Jack Rutherford Customs Brokers Ltd. is a Canadian customs brokerage c… |
| 2026-09-09 | Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer | A Canadian IT company based in Markham, Ontario, founded in 2015. It d… |
| 2026-09-09 | Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco | |
| 2026-04-30 | Bohmler Einrichtungshaus GmbH | |
| 2026-04-15 | Carrera Casting Corp. | |
| 2026-03-27 | PROMOSFERA S.R.l. | |
| 2026-03-27 | Quality Data Service, Inc. | |
| 2026-03-27 | KINAS SOLICITORS | |
| 2026-03-27 | Paramount Health Services & Insurance TPA Pvt. Ltd | |
| 2026-03-27 | The company MST (Sanko Makina and ASKO Holding) | |
| 2026-03-27 | E-CON Packaging Private Limited | |
| 2026-03-27 | Heng An Standard Life Insurance | |
| 2026-01-08 | Applied LNG www.appliedlng.com | file listing https://gofile.io/d/wsV8hlApplied LNG specializes in prov… |
| 2025-10-30 | LATCOM https://latcom.com/latcom/ | LATCOM.com145146 files, 1TBhttps://gofile.io/d/xNrNCufile listing, we … |
| 2025-10-29 | Yateem Group www.yateemgroup.com | 500+ gigabytes and over 100,000+ files availableThe Yateem Group owns … |
| 2025-10-27 | Trojan Construction & Holding Group www.trojan.ae | Over 3 terabytes of project and financial reporting data for 2024–2025… |
| 2025-10-13 | Undefasa www.undefasa.com | Ceramicists since 1967We are a family-run business that was establishe… |
| 2025-10-07 | T. Choithram And Sons, LLC www.choithrams.com/www.choithramsgcc.com | Choithrams is a prominent grocery retail chain and distributor in the … |
| 2025-09-29 | Caresoft Global caresoftglobal.com | Caresoft Global is a global engineering company specializing in soluti… |
| 2025-09-11 | CARTONAJES BERNABEU SAU www.cartonajesbernabeu.com serviced by IT company Verne Group www. | serviced by IT company Verne Group www.vernegroup.com (Cybersecurity a… |
| 2025-09-06 | OftalTech Solutions oftaltech.com | OftalTech Solutions is a leading distributor of ophthalmic products, o… |
| 2025-09-01 | SISTRAN Consultores www.sistran.com | 538k files1.1TBlisting data https://gofile.io/d/r8a9GVThe company spec… |
| 2025-08-28 | TOYOTA ASIA TOYOTA INDIA | Hello,I think your IT service hid from you information about the hacki… |
| 2025-08-07 | LEARN is a Regional Educational Service Center www.learn.k12.ct.us | LEARN is a Regional Educational Service Center working with and for it… |
| 2025-08-07 | Cash and carry - COSAEN GRUP www.cosaen.es | Cash and carry - COSAEN GRUPProfessionals in the food sectorюCosaen Gr… |
| 2025-08-07 | Dragonfly CO. LTD dragonflygame.com | Dragonfly is a South Korean video game developer and publisher based i… |
| 2025-08-06 | TANI & ABE www.taniabe.co.jp | TANI & ABE is a patent and trademark law firm established in 1977 and … |
| 2025-08-06 | CK Power Public Company Limited www.ckpower.co.th | CK Power Public Company Limited, through its subsidiaries, generates a… |
| 2025-08-06 | CHABAA BANGKOK www.chabaabangkok.com | Chabaa is the leading expert in fruit beverage production. 700 GB o… |
| 2025-08-06 | CILI www.cili.lt | "cili.lt" is associated with Čili, a restaurant chain that operates in… |
| 2025-08-06 | Dragonfly CO. LTD dragonflygame.com | Dragonfly is a South Korean video game developer and publisher based i… |
| 2025-08-06 | Quality Data Service, Inc. www.qds.biz | Today, we’re opening the auction. Over the past several weeks, we’v… |
| 2025-08-06 | KINAS SOLICITORS kinas.co.uk | In stock: 158930+ file data size: 138+ GB Clients' and companies… |
| 2025-08-06 | Cash and carry - COSAEN GRUP www.cosaen.es | Cash and carry - COSAEN GRUP Professionals in the food sectorю C… |
| 2025-08-06 | PROMOSFERA S.r.l. promosfera.com | passports, employee and client documents, databases of promotional par… |
| 2025-08-06 | CLEARSYNTH LABS LIMITED www.clearsynth.com | In stock: 2153940 file data size: 762GB Developments, formulas, … |
| 2025-08-06 | LEARN is a Regional Educational Service Center www.learn.k12.ct.us | LEARN is a Regional Educational Service Center working with and for it… |
| 2025-08-06 | Payme Ltd www.payme.co.uk | Payme Ltd is a CIS payroll and contracting company with FCSA and profe… |
CONFIRMED ATTACKS
Black Nevas confirmed attacks: 7 verified incidents
Ransomnews has verified 7 Black Nevas incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2025 to August 2026. Italy accounts for 1 of them (14%), with victims recorded in 7 countries in total. The most affected sector is finance, at 2 confirmed victims. Where a figure was disclosed (1 case), these incidents account for 2,200 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Black Nevas incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Mefa Endüstri A.Ş. | Manufacturing | Ankara, Turkey | 2,200 | Unknown | Source |
| June 2026 | Abans Financial Services Limited (overseas subsidiaries) | Finance | Mumbai, India | — | Unknown | Source |
| February 2026 | Heng An Standard Life Insurance | Finance | Hong Kong, Hong Kong | — | Unknown | Source |
| July 2025 | Dragonfly Co. Ltd. | Technology | Seoul, South Korea | — | Unknown | Source |
| June 2025 | LTK Food Group (Čili Pizza) | Food and Beverage | Vilnius, Lithuania | — | Unknown | Source |
| May 2025 | Promosfera S.r.l. | Service | Casorate Sempione, Italy | — | Unknown | Source |
| April 2025 | LEARN Regional Educational Service Center | Education | Connecticut, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Black Nevas's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.