Blacknevas

☆ pin

Also known as CryptoRex

Reports

First seen

Jun 29, 2026

Last seen

Jul 14, 2026

Motivation

Financial

Targeting

Sectors

Hospitality ×2 Financial Services ×2

Victim regions

×2

Cyprus×2

India×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1078 Valid Accounts ×2T1041 Exfiltration Over C2 Channel ×2T1005 Data from Local System ×2T1087 Account Discovery ×2T1021 Remote Services ×1

Indicators

domain ×7

Indicator values are available on Pro and via the API.

Recent reports

Critical

Blacknevas publishes Arkın Group hotel chain as ransomware victim; 1.4 TB of guest and casino data stolen

ransomware.liveJul 14, 2026 Medium

Blacknevas publishes L'azurde as new ransomware victim

ransomware.liveJul 14, 2026 Critical

Blacknevas publishes Arkin Group: 1.4 TB data breach of luxury hotel and casino operator

ransomware.liveJun 30, 2026 High

Blacknevas publishes Abans Group as ransomware victim

ransomware.liveJun 29, 2026 High

Blacknevas ransomware claims Abans Finserv as victim

ransomware.liveJun 29, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.