BlackNevas
aka Trial Recovery
A ransomware group that appeared around November 2024 and threatens to publish stolen data. It focuses heavily on Asia-Pacific, with victims in Japan, South Korea and Thailand among others.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
How they attack
Entry
Phishing and unpatched weaknesses
Like a fake delivery notice that gets you to open the door, or a window nobody got around to fixing.
Goal
Lock the data and threaten to leak it
Like locking the safe and also threatening to post copies of its contents around town.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily