BlackNevas Ransomware: A Rising Global Cyber Threat

BlackNevas Ransomware: Global Double-Extortion Campaign Targeting Critical Industries

Summary

First detected in November 2024, BlackNevas ransomware (also known as Trial Recovery) has evolved into a global double-extortion threat, impacting healthcare, finance, manufacturing, legal, and telecom sectors across Asia, Europe, and North America. This ransomware supports Windows, Linux, NAS devices, and VMware ESXi, combining AES-RSA encryption with aggressive data theft. Files are renamed with a distinctive “.-encrypted” extension, and victims receive ransom notes instructing them to negotiate via email or Telegram, under threat of public data leaks.

Attack Details

BlackNevas is a Trigona-family ransomware variant operating independently outside the typical Ransomware-as-a-Service model. Key characteristics include:

• Dual Encryption Mechanism: AES encrypts victim files while RSA protects the keys, rendering files undecryptable without the attacker’s private key.

• Multi-Platform Capability: Targets Windows, Linux, NAS devices, and ESXi hypervisors.

• Delivery Methods: Phishing campaigns and exploitation of unpatched vulnerabilities.

• Modular Command-Line Options: Attackers use switches like /full, /path, /fast to control encryption scope, and /erase or /shdwn to delete data or force shutdown.

• Operational Stealth: Skips critical OS files to keep systems bootable but locked.

• Extortion Tactics: Publishes stolen file inventories on leak sites to coerce payment.

• Global Reach: Nearly half of campaigns have hit Asia-Pacific, with notable attacks in Japan, Thailand, and South Korea, along with incidents in the UK, Italy, Lithuania, and the US.

Recommendations

• Patch and Update Systems: Regularly update OS, NAS devices, and virtualization platforms like VMware ESXi to close known vulnerabilities.

• Enforce Strong Access Controls: Apply least-privilege principles, limit admin rights, and secure sensitive data with strict access policies.

• Continuous Monitoring: Deploy EDR solutions to detect unusual encryption activity, file renaming, or lateral movement.

• Offline Backups: Maintain and routinely test offline or immutable backups to enable ransomware-free recovery.

• Network Segmentation: Isolate critical assets to prevent ransomware from spreading laterally.

Indicators of Compromise (IoCs)

MD5 Hashes

• 2374998cffb71f3714da2075461a884b

• 4a1864a95643b0211fa7ad81b676fe2e

• 9f877949b8cbbb3adfe07fd4411b9f26

• f2547a80dd64dcd5cba164fe4558c2b6

SHA1 Hashes

• 203f81cbe35c64071f52f34afbbbfc7d61b3e702

• 2a79c999e20c5d8102e0b728733cc8eba2b4d8ac

• 3226ebfc23dbe1a6cc44c3255d1a0e12f0dd153c

• 49551cb0bbc2da3f6d36523a005af5ee1f5ad1a8

• 812d65b67ce28905f5e07ac1f82b827ebd36470a

• 923be026c79e7b5b5d29461420887fe2e8875b01

SHA256 Hashes (Samples)

• 23642a78addcffd124db133a2dd2fcd2d1bdb060dd1e41da33cb18eec7a88867

• 3d09e930305cb3aa4ca54a39b0e3749f083d432f202606c8adac8455014b47fc

• c08a752138a6f0b332dfec981f20ec414ad367b7384389e0c59466b8e10655ec

Email Addresses

• amsomar[@]consultant[.]com

• black4over[@]newlookst[.]com

• suppcarter[@]uymail[.]com

• paymeuk[@]consultant[.]com

TOR Address

• hxxp[:]//ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid[.]onion

Recent Breach Victims

• cartonajesbernabeu.com

• oftaltech.com

• sistran.com

• toyota-asia.com

• taniabe.co.jp

• ckpower.co.th

• clearsynth.com

MITRE ATT&CK TTPs

• Initial Access: T1566 (Phishing), T1190 (Exploit Public-Facing Applications), T1078 (Valid Accounts)

• Execution: T1203 (Exploitation for Client Execution), T1059 (Command & Scripting Interpreter)

• Persistence: T1547 (Boot/Logon Autostart), T1547.001 (Registry Run Keys/Startup Folder)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation)

• Defense Evasion: T1070 (Indicator Removal), T1562 (Impair Defenses), T1027 (Obfuscated Files/Information)

• Discovery: T1083 (File & Directory Discovery), T1012 (Query Registry), T1135 (Network Share Discovery)

• Impact: T1486 (Data Encrypted for Impact), T1561.001 (Disk Content Wipe)

• Command & Control: T1071 (Application Layer Protocol)

References

• AhnLab – BlackNevas Analysis

• SentinelOne – BlackNevas Ransomware Anthology

• Hive Pro Threat Advisory – TA2025286