MalwarePublished 12 Sep 2025

Trigona Rebranding Suspicions and Global Threats, and BlackNevas Ransomware Analysis

Source AlienVault OTX General

Description

The BlackNevas ransomware group, first appearing in November 2024, has been targeting various industries and critical infrastructure globally, with a focus on the Asia-Pacific region. The group uses AES and RSA encryption, adding the '.-encrypted' extension to affected files. BlackNevas operates independently, threatening to leak data on their own site and through partners. The ransomware supports multiple arguments, excludes certain system paths and file types from encryption, and uses a unique method to check for previous infection. It also creates ransom notes in all accessible folders, demanding negotiation within seven days to prevent data leaks.

Impact

For European organizations, the BlackNevas ransomware presents a significant threat to confidentiality, integrity, and availability of data. The encryption of files using AES and RSA renders critical data inaccessible, potentially halting business operations, especially in sectors reliant on timely data access such as healthcare, manufacturing, and critical infrastructure. The threat of data leakage adds a reputational risk and potential regulatory consequences under GDPR, as leaked sensitive or personal data could lead to fines and legal actions. The seven-day negotiation window pressures organizations to respond quickly, which may lead to rushed decisions or payment of ransom. The ransomware’s exclusion of certain system paths may allow partial system functionality, but the overall impact remains disruptive. The unique infection check mechanism complicates remediation efforts, as reinfection attempts may be avoided but initial infection cleanup requires thoroughness. European organizations with interconnected networks or supply chains linked to Asia-Pacific may face increased exposure. The lack of known exploits in the wild suggests that infection vectors may rely on phishing, compromised credentials, or other initial access methods, emphasizing the need for strong perimeter defenses and user awareness. The medium severity rating reflects the ransomware’s strong encryption and data leak threats balanced against the absence of widespread exploitation in Europe so far.

Defensive guidance

1. Implement robust endpoint detection and response (EDR) solutions capable of detecting behaviors associated with BlackNevas, such as process injection (T1055), registry modifications (T1112), and file encryption activities (T1486). 2. Enforce strict network segmentation to limit lateral movement and contain infections. 3. Maintain regular, offline, and immutable backups of critical data to enable recovery without paying ransom; ensure backup systems are isolated from production networks. 4. Conduct targeted threat hunting for indicators of compromise, including the provided file hashes, and monitor for the '.-encrypted' file extension. 5. Harden systems by disabling unnecessary services and restricting administrative privileges to reduce attack surface. 6. Deploy multi-factor authentication (MFA) to prevent credential compromise. 7. Educate employees on phishing and social engineering tactics to reduce initial infection risk. 8. Monitor and restrict use of scripting environments and command interpreters to detect suspicious activity. 9. Implement application allowlisting to prevent execution of unauthorized binaries. 10. Prepare and test incident response plans that include rapid isolation of infected systems and communication protocols for ransom negotiation and regulatory reporting. 11. Regularly update and patch systems to close vulnerabilities that could be exploited for initial access, even though no specific CVEs are linked to BlackNevas. 12. Collaborate with threat intelligence sharing communities to stay updated on BlackNevas developments and emerging indicators.

Indicators of compromise

Hashes 6

2374998cffb71f3714da2075461a884b
4a1864a95643b0211fa7ad81b676fe2e
9f877949b8cbbb3adfe07fd4411b9f26
f2547a80dd64dcd5cba164fe4558c2b6
d5486a14ef0cd5f9aae9d4fb3321a7b72cbb28ef
ae5cec8b64404037d86f12d1261e669819c84675c74fe09a57cda5099109d8e2

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Sep 2025, 08:12 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

Hashes 6

Community reviews

Related threats