We've just wrapped up the new design, along with a ton of other improvements. Check them all out in the Changelog.

Ransomware Group intelligence

Blacknevas

Active

Track Blacknevas with 74 published victims and 1 known leak locations in a single intelligence view.

DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 74 Known published victims in this dataset
First discovered 2025-08-06 Earliest victim discovery date
Last discovered 2026-10-19 Latest victim discovery date
Inactive since 12 days Days since the latest known victim
Top country United States 22 victims
Known locations 1 Leak or negotiation infrastructure tracked

Overview

Blacknevas is tracked by Dark Eye as a ransomware group with 74 published victims.

United States is currently the most targeted country in this dataset.

1 known leak locations are currently associated with this group.

Leak Status Distribution

  • Leaked 9 12.2%
  • Pending 64 86.5%
  • Deleted 1 1.4%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (1)

    Label Type Availability Links
    Leak location 1 Onion service Up checked 4h ago ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion

    Top Activity Sectors (14)

    Victims (74)

    Search, filter and paginate the victim timeline for Blacknevas. Showing 1–74 of 74.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware abansfinserv.com id35233 View details United States Finance / Legal / Insurance pending
    Ransomware abansfinserv.com id35173 View details Kenya Finance / Legal / Insurance pending
    Ransomware www.cosaen.es id35082 View details Spain Manufacturing / Engineering pending
    Ransomware abansfinserv.com id35081 View details United States Finance / Legal / Insurance pending
    Ransomware Payme Ltd www.payme.co.uk id35015 View details United Kingdom Finance / Legal / Insurance pending
    Ransomware Quality Data Service, Inc. www.qds.biz id35016 View details United States IT pending
    Ransomware LEARN is a Regional Educational Service Center www.learn.k12.ct.us id35017 View details United States Education pending
    Ransomware CLEARSYNTH LABS LIMITED www.clearsynth.com id35019 View details United States Manufacturing / Engineering pending
    Ransomware CHABAA BANGKOK www.chabaabangkok.com id35011 View details Thailand Services pending
    Ransomware CILI www.cili.lt id35013 View details Lithuania Services pending
    Ransomware SISTRAN Consultores www.sistran.com id35007 View details Peru Services pending
    Ransomware TANI & ABE www.taniabe.co.jp id35009 View details Japan Manufacturing / Engineering pending
    Ransomware CK Power Public Company Limited www.ckpower.co.th id35010 View details Thailand Energy pending
    Ransomware LATCOM https://latcom.com/latcom/ id35001 View details United States IT pending
    Ransomware Undefasa www.undefasa.com id35002 View details Egypt Services pending
    Ransomware T. Choithram And Sons, LLC www.choithrams.com/www.choithramsgcc.com id35004 View details United States Services pending
    Ransomware CARTONAJES BERNABEU SAU www.cartonajesbernabeu.com serviced by IT company Verne id35005 View details Spain Transportation / Travel / Logistics pending
    Ransomware www.lazurde.com id34997 View details United States Retail / E-commerce pending
    Ransomware www.arkingroup.com id34998 View details United States Services pending
    Ransomware Yateem Group www.yateemgroup.com id34999 View details Saudi Arabia Services pending
    Ransomware Trojan Construction & Holding Group www.trojan.ae id35000 View details United Arab Emirates Construction / Real Estate pending
    Ransomware computercountry.ca id34994 View details Canada IT pending
    Ransomware www.ascom-italy.it serviced by www.emilcom.it id34995 View details Italy IT pending
    Ransomware speedgroupe.com / speedfrance.fr id34996 View details France Services pending
    Ransomware www.mefagroup.com.tr / www.mefaendustri.com id34993 View details Türkiye Manufacturing / Engineering pending
    Ransomware Amity University Dubai id33877 View details United Arab Emirates — pending
    Ransomware Optimum First Mortgage (Pear's acting group's promotional blog) id32914 View details United States Services leaked
    Ransomware Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco... id32675 View details Türkiye Manufacturing / Engineering pending
    Ransomware ASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. id31671 View details Italy IT leaked
    Ransomware Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... id31655 View details United States IT pending
    Ransomware Westbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer C... id31647 View details United States IT pending
    Ransomware Enteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co... id31648 View details United States IT deleted
    Ransomware Jack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an IT ... id31649 View details Canada Services pending
    Ransomware COMPUTER COUNTRY AND NETWORKS id31645 View details — — leaked
    Ransomware OTEGROUP id31473 View details United States IT leaked
    Ransomware Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach id31242 View details Türkiye Hospitality / Food & Beverage / Tourism leaked
    Ransomware Speed Group id31018 View details — Other leaked
    Ransomware Zuni Shopping Center, Inc. id30760 View details United States Retail / E-commerce pending
    Ransomware Arkın Group id30552 View details Türkiye Construction / Real Estate pending
    Ransomware L'azurde id30541 View details Saudi Arabia Retail / E-commerce leaked
    Ransomware Abans Group id30095 View details Sri Lanka Retail / E-commerce leaked
    Ransomware Arkin Group id30109 View details Türkiye Finance / Legal / Insurance pending
    Ransomware Abans Finserv id30157 View details India Finance / Legal / Insurance leaked
    Ransomware PROMOSFERA S.R.l. id28394 View details Spain Retail / E-commerce pending
    Ransomware KINAS SOLICITORS id28395 View details United Kingdom Retail / E-commerce pending
    Ransomware Paramount Health Services & Insurance TPA Pvt. Ltd id28396 View details India Finance / Legal / Insurance pending
    Ransomware The company MST (Sanko Makina and ASKO Holding) id28397 View details Türkiye Manufacturing / Engineering pending
    Ransomware E-CON Packaging Private Limited id28398 View details India IT pending
    Ransomware Heng An Standard Life Insurance id28399 View details Hong Kong Finance / Legal / Insurance pending
    Ransomware Carrera Casting Corp. id28400 View details United States Services pending
    Ransomware Bohmler Einrichtungshaus GmbH id28401 View details Germany Retail / E-commerce pending
    Ransomware Applied LNG id25369 View details United States Energy pending
    Ransomware LATCOM id23519 View details Argentina Communication / Marketing pending
    Ransomware Yateem Group id23466 View details Bahrain Public Sector pending
    Ransomware Trojan Construction & Holding Group id23407 View details United Arab Emirates Construction / Real Estate pending
    Ransomware Undefasa id23012 View details Spain Communication / Marketing pending
    Ransomware T. Choithram And Sons, LLC id22851 View details United States Communication / Marketing pending
    Ransomware Caresoft Global caresoftglobal.com id22655 View details United States Manufacturing / Engineering pending
    Ransomware CARTONAJES BERNABEU SAU www.cartonajesbernabeu.com serviced by IT company Verne Group www.... id22301 View details Spain Communication / Marketing pending
    Ransomware OftalTech Solutions oftaltech.com id22158 View details United States IT pending
    Ransomware SISTRAN Consultores id22075 View details Mexico Services pending
    Ransomware TOYOTA ASIA TOYOTA INDIA id22012 View details India Telecommunications pending
    Ransomware Payme Ltd id21581 View details United Kingdom Finance / Legal / Insurance pending
    Ransomware LEARN is a Regional Educational Service Center id21580 View details United States Education pending
    Ransomware CLEARSYNTH LABS LIMITED id21579 View details India Communication / Marketing pending
    Ransomware PROMOSFERA S.r.l. promosfera.com id21578 View details Italy Communication / Marketing pending
    Ransomware Cash and carry - COSAEN GRUP id21577 View details Spain Communication / Marketing pending
    Ransomware KINAS SOLICITORS kinas.co.uk id21576 View details United Kingdom Communication / Marketing pending
    Ransomware Quality Data Service, Inc. id21575 View details United States Communication / Marketing pending
    Ransomware Dragonfly CO. LTD dragonflygame.com id21574 View details Japan Retail / E-commerce pending
    Ransomware CILI id21573 View details Lithuania Hospitality / Food & Beverage / Tourism pending
    Ransomware CHABAA BANGKOK id21572 View details Thailand Communication / Marketing pending
    Ransomware CK Power Public Company Limited id21570 View details Thailand Energy pending
    Ransomware TANI & ABE id21569 View details Japan Finance / Legal / Insurance pending