BlackNevas Ransomware: A Persistent Global Threat With Impossible-to-Decrypt Payloads

According to AhnLab, BlackNevas is a ransomware group that has been steadily launching attacks across industries and regions since late 2024, with operations focused on the Asia-Pacific region but extending to Europe and North America. The group’s targets are primarily in the Asia-Pacific region, accounting for 50% of activity, including Japan, Thailand, and Korea, with Europe featuring Western Europe and the Baltic Sea region (including the UK, Italy, and Lithuania) and North America pinpointed at Connecticut.

BlackNevas uses a hybrid AES plus RSA encryption scheme, where a randomly generated AES key is encrypted with an RSA public key and appended to the file, making decryption impossible unless the RSA algorithm itself is broken. Encrypted files carry the .-encrypted extension, sometimes renamed with a trial-recovery prefix to demonstrate decryptability if ransom is paid, and victims receive a ransom note named how_to_decrypt.txt in every accessible folder.

The group does not operate as a Ransomware-as-a-Service, but maintains a data leak site and threatens to publish or auction off stolen data if victims refuse to pay. AhnLab notes that there is no possibility of decryption unless the RSA algorithm is compromised, and highlights the 7-day window stated in the note for negotiating decryption.