BlackNevas Ransomware Encrypts Files, Exfiltrates Corporate Data

BlackNevas is a sophisticated dual‑extortion ransomware group operating across Asia‑Pacific (50% of operations), Western Europe, and select U.S. targets; it encrypts files using per‑file AES keys wrapped with RSA, appends a distinctive ".-encrypted" extension (with special "trial-recovery" naming for demonstration files), supports multiple command-line modes (/fast, /full, /allow_system, /debug, /stealth, /shdwn), performs runtime path analysis to avoid system-critical directories, and threatens stolen data via a proprietary data leak site and partner networks—requiring organizations to focus on prevention, EDR/behavioral detection, and anti‑exfiltration controls.