BlackNevas Ransomware Recovery: Trigona Variant Hitting Asia, NAS and ESXi

BlackNevas, also tracked as Trial Recovery, appeared in November 2024. Hive Pro describes it as derived from the Trigona ransomware family, and AhnLab's ASEC notes that it does not officially run as a ransomware-as-a-service. About half of its victims are in Asia-Pacific, including Japan, Thailand and Korea, with others in Europe and North America. ransomware.live counts about 48 victim claims, with new posts in September 2026.

Files are encrypted with AES and the keys protected with RSA, and encrypted files get the extension .-encrypted. Builds exist for Windows, Linux, NAS devices and VMware ESXi hypervisors. Entry is through phishing and unpatched vulnerabilities, and stolen file lists are posted on a leak site for double extortion. Hive Pro reports a "trial recovery" feature covering common document types, most likely offered to victims as proof that decryption works.

Without the attacker's key, recovery works from the parts of each file that were not encrypted. We measure that on your actual SQL Server and Oracle databases, NAS volumes, virtual disks and backups, and recover tables, virtual machines and files from the intact parts.

Keep the encrypted files and a copy of them, do not reinitialise the NAS or reinstall the hosts, and contact us for a free assessment. No data, no charge.