Threat Intelligence Report March 24 - March 30 2026

BlackNevas Ransomware

BlackNevas ransomware, also referred to as Trial Recovery, is a direct derivative of the Trigona ransomware family that first emerged in late 2024. It has rapidly expanded into a global double-extortion operation targeting large enterprises across healthcare, finance, manufacturing, legal, and telecommunications sectors.

Unlike typical Ransomware-as-a-Service operations, BlackNevas operates independently and does not franchise its payloads. Instead, the operators partner with established ransomware groups (Kill Security, Hunters International, DragonForce, Blackout, Embargo Team, and Mad Liberator) to publish stolen data on their respective leak sites. This partnership model mirrors the approach previously used by the RADAR/Dispossessor operation.

The ransomware employs a hybrid encryption scheme combining AES-256 symmetric encryption with RSA-4112 public key cryptography in Output Feedback (OFB) mode. Configuration data is embedded within each payload and encrypted using multiple layers of AES in CBC mode. Once files are encrypted, no further network communication is performed, significantly reducing detection opportunities post-encryption.

Victims are directed to negotiate via victim-specific email addresses and the @BlackNevas Telegram channel. Ransom notes threaten data publication to partner DLS sites within 7 days if demands are not met. A TOR-based extortion site has been identified at ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid[.]onion.

Detailed Tactics, Techniques and Procedures (TTPs)
 

MITRE ATT&CK Mapping

Validated Command-Line Arguments

The following arguments were confirmed through ASEC debug-mode analysis of live BlackNevas samples:

Encryption Behaviour & File Exclusions

Excluded extensions (to maintain system stability): .sys, .dll, .exe, .log, .bmp, .vmem, .vswp, .vmxf, .vmsd, .scoreboard, .nvram, .vmss. Excluded files: NTUSER.DAT, how_to_decrypt.txt.

Trial-recovery naming convention applied to demonstration files with extensions: .doc, .docx, .hwp, .jpg, .pdf, .png, .rtf, .txt. These files receive the naming format trial-recovery.[random].[random].-encrypted to prove decryption capability to victims

Mitigation

Gateway AV + IDPS (Security Ruleset, Detection & Protection Mode) - Blocks BlackNevas payloads at the perimeter.

Network Segmentation + Inline IDPS per Zone - BlackNevas inherits Trigona's SMB enumeration/spreading capability (toggled via /!lan flag).

ForceField Brute-Force Protection + ZTNA/IAM - BlackNevas operators use valid accounts (T1078) for initial access. ForceField auto-blocks source IPs exceeding failed login thresholds.

DLP + DNS.Insure + Content Filtering - Counters the double-extortion data theft. Configure CE DLP policies to detect anomalous large-volume outbound transfers. Enable DNS.

CE AAI Threat Intelligence Feeds + IOC Blocklists - Ingest all validated BlackNevas IOCs (4 MD5s, 3 SHA256s, 4 operator email addresses, TOR DLS address) into CE custom blocklists. CE's Automated Actionable Intelligence integration with the Cyber Threat Alliance ensures continuously updated signatures as new BlackNevas variants emerge.

Indicators of Compromise (IOCs)

Network / Communication IOCs

Host-Based Artefacts

Iran-US-Israel Cyber War IOCs

MuddyWater / MOIS Active C2 Nodes

JaJoJoo LLC Certificate-Spoofing Infrastructure

APT42 Academic Phishing Cluster

Cotton Sandstorm / APT28 Overlap Domains

Named OTX Pulses