Loading threat actor…
Black Nevas, also known as blacknevas and black_nevas, is a ransomware and data-extortion group that publicly claims organizational victims through a dedicated leak site. Its geographic targeting includes the United States, Canada, Saudi Arabia, and South Korea. Its claimed victims span financial services, information technology, healthcare, manufacturing, logistics, retail, and hospitality. Named victims include Optimum First Mortgage, Portable Intelligence, Enteroptyx Ophthalmology Products, The Rutherford Group, Westbrook Greenhouse Systems, Speed Group, Zuni Shopping Center, and L’azurde. The group claims theft of sensitive business and personal information, including financial and human-resources records, customer databases, email correspondence, technical documentation, and production data. Individual breach claims and reported data volumes are not independently established. Its country of origin, organizational structure, initial-access methods, and specific ransomware tooling are not established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BlackNevas lists Cosaen Grup SA, a Spanish food and beverage wholesaler and retailer, as a victim and claims to hold 243 GB across 983,158 files. The post is marked "PUBLISHED," links to a purported file list, offers samples on request, and solicits buyers without specifying a ransom amount or deadline.
BlackNevas lists Abans Group's financial-services business, identified by abansfinserv.com, as a victim discovered on October 18, 2026, with the status "PUBLISHED." The supplied post specifies no stolen-data volume, data types, ransom demand, deadline, or supporting samples.
BlackNevas lists OTE Group, an Oman-based diversified business group, as a victim and marks the entry "PUBLISHED." The post provides a company profile but no stolen-data volume, data types, ransom demand, deadline, or supporting evidence of compromise.
BlackNevas lists Westbrook Greenhouse Systems (westbrooksystems.com) with a status of "PUBLISHED" and a discovery date of October 18, 2026. The post provides no stolen-data volume, data types, ransom demand, deadline, or verifiable proof of compromise.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.