BlackNevas Ransomware Encrypts Files, Exfiltrates Corporate Data

BlackNevas is described as a ransomware operation with a dual-extortion model that encrypts files and steals sensitive data, reportedly focusing 50% of its activity in the Asia-Pacific region. The group’s Asia-Pacific targets include Japan, Thailand, and South Korea, while European operations concentrate on Western Europe and Baltic Sea nations such as the United Kingdom, Italy and Lithuania, with Connecticut in the United States singled out in North America.

The malware uses a hybrid AES-RSA encryption scheme, appends a “.-encrypted” extension to files, and creates a unique data structure containing encrypted AES keys and metadata within the infected files to make recovery practically impossible without the attackers’ private key. It preserves its ransom note “how_to_decrypt.txt” and the NTUSER.DAT file, and employs a two-pronged threat approach through its own data leak site and partner networks to pressure victims.

Victims are warned with a seven-day deadline for initial contact, and communications are conducted via email and Telegram as part of negotiations. The operators reportedly execute targeted encryption with configurable modes and a path-agnostic runtime strategy that avoids system32 and Windows directories, enhancing stealth during large-scale deployments.

Published on 15 September 2025, the analysis highlights the group’s emphasis on high-value targets with substantial digital infrastructure and its aggressive, globally distributed approach.