SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

black nevas

16 Einträge insgesamt

Zeitraum: 09.09.2026 – 15.10.2026

BlackNevas ransomware — also referred to as “Trial Recovery” — was first observed in November 2024. It is a direct derivative of the Trigona ransomware family and continues the lineage's focus on extortion over public shaming. BlackNevas operators support a double-extortion model, encrypting files using AES-256 with RSA-4112-protected keys, and appending the .-encrypted or .ENCRYPTED file extension to affected files. Hybrid payloads are available for Windows, Linux, NAS, and VMware ESXi platforms. While BlackNevas does not host its own data leak site, it reportedly collaborates with other ransomware groups for data publication — known partners include Kill Security, Hunters International, DragonForce, Blackout, Embargo Team, and Mad Liberator. The group has predominantly targeted large enterprises in sectors such as finance, telecommunications, manufacturing, healthcare, and legal. Initial access is commonly achieved via phishing or exploitation of vulnerabilities, with lateral movement facilitated through SMB enumeration and optional LAN-wide propagation.

Veröffentlichungskanäle

  • Leak-Seite · DLS · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Keine Meldung im Bestand nennt diese Gruppe — sie arbeitet unbeachtet. Das ist der Regelfall: von 81 aktiven Gruppen haben 23 ein Medienecho.

Neueste Einträge

Filter zurücksetzen
black nevasAmity University DubaiAE

Herkunft

black nevasOptimum First Mortgage (Pear's acting group's promotional blog)—

Herkunft

black nevasCash and carry - COSAEN GRUP—

Beschreibung der Täter

Cash and carry - COSAEN GRUPProfessionals in the food sectorюCosaen Grup SA has wholesale and retail warehouses offering a wide range of food and beverage products, as well as fresh and dry goods.[Link entfernt] stock: 983158 filedata size: 243GBList of files, to confirm that we have all the files, you can request several files from the list and we will provide them to you.[Link entfernt] ask all our partners, friends and clients to contact us to discuss the acquisition of this data. You know the contacts. For new members, please wait in the Contacts tab.Advertising:We are always ready to cooperate in any form, do you need specific data? We will try to provide it to you as soon as possible, we will receive and download your competitors' data, provide a list of what you are interested in. We are also ready to cooperate with law firms and data leak victims. We will provide all the information you need about the company that was negligent and provided access to data to its clients.

Herkunft

  • goods.https
  • Pfad auf der Leak-Seite: /a2282bbe-c123-400e-80d8-20375985e520
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasPROMOSFERA S.r.l.—

Beschreibung der Täter

passports, employee and client documents, databases of promotional participants - hundreds of thousands of emails + full names, tens of thousands of emails + full names + phone numbersinternal company documentationhttps://gofile.io/d/5gNeSzhttps://gofile.io/d/dY7rYEWe ask all our partners, friends and clients to contact us to discuss the acquisition of this data. You know the contacts. For new members, please wait in the Contacts tab.Advertising:We are always ready to cooperate in any form, do you need specific data? We will try to provide it to you as soon as possible, we will receive and download your competitors' data, provide a list of what you are interested in. We are also ready to cooperate with law firms and data leak victims. We will provide all the information you need about the company that was negligent and provided access to data to its clients.

Herkunft

  • gofile.io
  • Pfad auf der Leak-Seite: /4401a68f-4fb6-4e94-a6af-c9d26c8a9c2a
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasAbans Group—

Beschreibung der Täter

The Abans Group is a globally diversified organization engaged in Investment Management, Trading, Broking, Gold Refining, Non-Banking Financial Services, Agricultural Trading, Software Development, and Real Estate Development.We are globally diversified organisation engaged in Financial Services, Gold Refining, Jewellery, Commodities Trading, Agricultural Trading and Warehousing, Pharmaceuticals Distribution, Software Development and Real Estate. The group is founded by young entrepreneur - Mr. Abhishek Bansal who leads a global team of over 300 people operating growing businesses from multiple locations including India, United Kingdom, Dubai, Shanghai, Hong kong, Mauritius and Singapore.Our Company represents the financial services arm of the Abans Group. We operate a diversified global financial services business, headquartered in India, providing NBFC services, multi-asset global institutional trading in equities,Since the inception of our Company in 2009-10, we have grown from being a commodities trading company into a diversified multi-asset and multi-national financial services company having varied financial services businesses which are mainly organised under:NBFC Business:

Herkunft

  • development.we
  • Pfad auf der Leak-Seite: /21316412-7321-43e4-bd3a-6f7ef5811446
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasArkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm BeachUS
kein Firmenname im Eintrag

Beschreibung der Täter

Arkın Group is a Turkish Cypriot company group primarily operating in Northern Cyprus (TRNC). It was founded by Erbil Arkin, who serves as Chairman. The group has around 25–30 years of experience, employs over 3,000 people, and maintains international offices.Main ActivitiesThe group began in the hospitality sector and expanded over time:The Arkın Colony Hotel (Kyrenia/Girne) — the group’s first hotel, marking its entry into hospitality.Arkın Palm Beach Hotel (Famagusta/Gazimağusa) — a hotel with an associated casino that contributed significantly to North Cyprus tourism.The Arkın Iskele Hotel (Iskele, opened in 2022) — a modern property featuring approximately 1 km of beach, restaurants, entertainment facilities, and a casino.Casinos operate alongside the group’s hotels (including Arkın Casino facilities).Beyond hospitality and gaming, the group is involved in:Yachting and boat building (Arkin Pruva Yachts, including eco-friendly models);Education — ARUCAD (Arkın University of Creative Arts and Design), opened in 2017 as a specialized university focused on art, design, and communication;Marina management — in 2024 the group assumed management of the luxury Karpaz Gate Marina resor

Herkunft

  • offices.main
  • Pfad auf der Leak-Seite: /281c9c40-9afe-413a-af7e-9cf7c3fdf3c0
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus dem Text abgeleitet
black nevasL'azurde—

Beschreibung der Täter

L'azurdeL'azurde Company for Jewelry is a prominent Middle Eastern jewelry manufacturer and retailer, headquartered in Riyadh, Saudi Arabia.Founded in the 1980s, it designs, manufactures, and sells gold, diamond, and gemstone jewelry across the Kingdom, Egypt, the UAE, Kuwait, Oman, and Qatar.Core InformationBrands: Operates under several lines including L'azurde, Instyle, Miss L', and Waves.Business Segments: Focuses on both wholesale distribution to independent jewelers and direct-to-consumer retail.Public Listing: Listed on the Saudi Stock Exchange (Tadawul) under the symbol 4011.Accessibility: Offers both online shopping and a vast physical footprint of stores across the region.

Herkunft

  • arabia.founded
  • Pfad auf der Leak-Seite: /adf52520-5448-4c49-8e3a-5488d52cf81c
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasSpeed Group—

Beschreibung der Täter

Speed ​​Group (speedgroupe.com / speedfrance.fr) is a global leader in the manufacture of synthetic monofilament lines. The company was founded in France over 40 years ago. Today, Speed ​​Group operates four manufacturing plants located in France, the USA, Chile, and South Africa. It specializes in the extrusion of high-quality monofilaments—particularly trimmer lines—and ranks among the world's leading players in this sector. The company also produces technical monofilaments for other industries. Since 2004, it has been part of the Italian Emak Group (Tecomec). Speed ​​Group is renowned for its high product quality, rigorous production controls, and excellent service.Cyber Attack on Speed Group (speedgroupe.com)World leader in monofilament lines manufacturing — Speed Group — has been hit by a cyber attack. Hackers breached the company’s systems and stole confidential data.More than 1 terabytes of information were exfiltrated, including technical documentation, customer databases and production data from factories in France, USA, Chile, and South Africa.The company has not issued an official statement yet. #SpeedGroup #CyberAttack #DataBreach

Herkunft

  • speedgroupe.com
  • Pfad auf der Leak-Seite: /9f3aadba-9ad7-40ec-92c9-8a42c918d76a
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasOTEGROUP—
automotive

Beschreibung der Täter

OTE Group, founded in 1991, is one of Oman's leading business groups and part of Saad Bahwan Holding — a family-run enterprise and one of the oldest and largest privately owned business houses in Oman, with interests in over 15 industries and 30+ companies across the Gulf region.Starting as a small, one-franchise business, OTE Group has grown into a diversified powerhouse operating in 14 industries across 4 countries — Oman, UAE, Saudi Arabia, and Algeria — with 200+ customer touchpoints, and continued expansion underway.The group's core business spans automotive (exclusive distributor for brands like Cadillac, Chevrolet, Hyundai, Isuzu, Subaru, and GWM), electronics and home appliances, and polymer color concentrates for the plastics industry, alongside historical interests in auto parts, lubricants, tires, batteries, vehicle leasing, and vocational training. The company credits its growth to collaboration, cross-cultural understanding, and talent development.

Herkunft

  • region.starting
  • Pfad auf der Leak-Seite: /f8830413-b940-4d3e-899c-7deb7cc7816e
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasASCOM S.p.A. ascom-italy.it serviced by an IT company Emilcom S.r.l. www.emilcom.itIT
kein Firmenname im Eintrag

Beschreibung der Täter

ASCOM S.p.A. is an Italian manufacturer of heavy lifting equipment for the marine (marinas & shipyards) and industrial sectors. Founded in 1972 by Gian Franco Schedoni in Formigine (Modena), the company began with overhead cranes and expanded into boat hoists (travel lifts) around 1982.Today it is a global specialist in travel lifts, gantry cranes, overhead cranes, and fully customized lifting solutions, with thousands of machines operating in over 50 countries. Production is fully in-house (9,000 m² facility), supported by its own engineering team using FEM analysis and modern CAD tools.Key facts:Certified ISO 9001, 14001 & 45001; all equipment CE-markedFocus on quality, customization, and sustainabilityServes marinas, shipyards, infrastructure, steel mills, renewable energy, mining, and moreHeadquarters: Via Della Fornace 16, 41043 Formigine (MO), ItalyPhone: +39 059 558038Email: info@ascom-italy.itWebsite: ascom-italy.it

Herkunft

  • ascom-italy.it
  • Pfad auf der Leak-Seite: /ce0e49bd-ae59-477d-abf8-af67fe2a29c0
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus der Domain abgeleitet
black nevasCOMPUTER COUNTRY AND NETWORKSCA

Beschreibung der Täter

A local Canadian IT company based in Stratford, Ontario, operating since 1983. It provides services to small and medium-sized businesses as well as private clients in the Stratford–St. Marys–Mitchell region and surrounding areas. Core services:Computer and laptop repairNetwork setup and supportServer installation and maintenanceVirus removal and system optimizationPOS systems (point-of-sale equipment)On-site serviceA small local service company with over 40 years of experience.

Herkunft

  • Pfad auf der Leak-Seite: /80fc5086-bf81-4cb1-beb4-ddf5c5b598d9
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus dem Text abgeleitet
black nevasWestbrook Greenhouse Systems www.westbrooksystems.com serviced by an IT company Computer CCA
kein Firmenname im Eintrag

Beschreibung der Täter

A Canadian family-owned company (part of the Westbrook Group of Companies) founded over 50 years ago. It specializes in the design, manufacturing, and installation of commercial greenhouses and related equipment (structures, heating and ventilation systems, benches, and handling materials).Its headquarters and manufacturing facilities are located in the Niagara region (Beamsville, Ontario). It serves clients across North America and operates its own factory spanning approximately 80,000 square feet.

Herkunft

  • www.westbrooksystems.com
  • Pfad auf der Leak-Seite: /fadee59c-ae05-4149-a569-e553a06c5ec5
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus dem Text abgeleitet
black nevasEnteroptyx Ophthalmology Products www.enteroptyx.com serviced by an IT company Computer Co—
kein Firmenname im Eintrag

Beschreibung der Täter

There is very little public information available about this company. Judging by its name, it is a small supplier or manufacturer of ophthalmology products (equipment, consumables, or instruments for eye care). There is virtually no detailed data regarding its operations, location, or history in open sources.

Herkunft

  • www.enteroptyx.com
  • Pfad auf der Leak-Seite: /e5ed8156-9986-4589-abe1-1a42c865f891
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026
black nevasJack Rutherford Customs Brokers Ltd / The Rutherford Group www.therg.ca serviced by an ITCA
kein Firmenname im Eintrag

Beschreibung der Täter

Jack Rutherford Customs Brokers Ltd. is a Canadian customs brokerage company currently operating under the brand name The Rutherford Group. The company provides comprehensive logistics services, primarily: customs brokerage (import and export clearance, clearance through Canadian and US customs, compliance consulting, CARM, surety bonds, etc.). They have PIP (Partners in Protection) status.Transportation: shipping within Canada, the US, and internationally.Warehousing: bonded warehouses (including CBSA sufferance), pick & pack, storage, including FDA-certified warehouses in Port Huron, Michigan.The company was founded in 1974 by Jack Rutherford in Stratford, Ontario. Now a family-owned business (second generation – John Rutherford), it positions itself as a one-stop shop for cross-border logistics.

Herkunft

  • www.therg.ca
  • Pfad auf der Leak-Seite: /e3eb3b89-131b-4e57-83fd-3fcb58ac35c9
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus der Domain abgeleitet
black nevasMefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, EcoTR
kein Firmenname im Eintrag

Herkunft

  • www.mefagroup.com.tr
  • Pfad auf der Leak-Seite: /0f3835e6-8681-4baa-8b8e-1706d91e7ec4
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus der Domain abgeleitet
black nevasPortable Intelligence Inc www.portable-intelligence.com serviced by an IT company ComputerCA
kein Firmenname im Eintrag

Beschreibung der Täter

A Canadian IT company based in Markham, Ontario, founded in 2015. It develops software for warehouse management and automation (Warehouse Management Systems).Key products:RF Plus — a barcode scanning and inventory tracking system for ERPs (specifically Infor VISUAL)TED — a warehouse task management and tracking platformSolutions for forklift tracking, RTLS (Real-Time Locating Systems), and machine visionIt works primarily with manufacturers in North America.

Herkunft

  • www.portable-intelligence.com
  • Pfad auf der Leak-Seite: /334ea365-5531-4a9e-902e-8936568e0e87
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 09.09.2026 · Land aus dem Text abgeleitet

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.