BLACKNEVAS Ransomware: MSP Supply-Chain Intrusion Yields 5 Victims in 48 Hours — Sector Analysis & Detection Engineering

Between 2026-08-12 and 2026-08-13, the BLACKNEVAS ransomware operation published five new victims to its dark web leak site. The victimology tells a story more important than the raw count: four of the five listed victims are explicitly annotated as "serviced by an IT company Computer..." — and the fifth victim is COMPUTER COUNTRY AND NETWORKS itself, a managed IT services provider. This is a textbook MSP pivot / supply-chain ransomware deployment: one upstream compromise, multiple downstream detonations, staged victim postings to maximize pressure.

Any organization whose IT is managed by a small or mid-sized MSP — particularly in North America — should treat this bulletin as an immediate action item, not background reading.

Threat Actor Profile — BLACKNEVAS

Confidence note: Attribution details for emerging groups are inherently fluid. The technical indicators and TTPs below are the reliable portion of this intelligence — tune detections to behaviors, not names.

Current Campaign Analysis

Sector targeting

• Technology (2 victims — including the MSP itself)
• Professional Services (customs brokerage — cross-border trade data)
• Healthcare (ophthalmology products — PHI-adjacent supply chain)
• Agriculture and Food Production (greenhouse systems — operational technology adjacency)

This spread is consistent with opportunistic downstream victimization, not deliberate sector selection. BLACKNEVAS did not choose an ophthalmology firm and a greenhouse operator; it chose one MSP and inherited its client book. The sector mix reflects a typical small-MSP customer portfolio.

Geographic concentration

Confirmed victims are in the United States and Canada. The customs-brokerage victim (cross-border US/CA trade) reinforces a North American operational focus — consistent with the KEV edge-device CVEs in their toolkit, which target perimeter gear common in North American SMB/MSP environments.

Victim profile

All identified victims are SMB-to-mid-market organizations (estimated 20–250 employees, ~$3M–$60M annual revenue). These organizations typically:

• Outsource IT entirely to an MSP
• Lack internal SOC capability
• Run perimeter VPN/firewall appliances with inconsistent patch cadence
• Use shared RMM tooling managed by the provider — the exact pivot mechanism observed here

Posting cadence and escalation pattern

• 2026-08-12: Four victims posted simultaneously (batch disclosure — typical of a single intrusion with multiple downstream victims)
• 2026-08-13: One additional victim posted (staggered release to sustain pressure on non-paying victims)

Staggered posting of victims from the same intrusion is an established negotiation tactic: each new posting demonstrates intent to the remaining unposted victims. Expect at least one more wave if negotiations stall.

CVE correlation — likely initial access vectors

The following CISA KEV entries align directly with this campaign's profile:

1. CVE-2024-1708 (ConnectWise ScreenConnect path traversal / RCE) — the strongest candidate. ScreenConnect is ubiquitous in small-MSP environments and provides exactly the trusted downstream pivot observed. This CVE being added to KEV as recently as 2026-04-28 indicates renewed exploitation waves.
2. CVE-2026-50751 (Check Point Security Gateway IKEv1 improper authentication) — perimeter VPN exploitation; likely the initial door into the MSP itself.
3. CVE-2026-20131 (Cisco FMC deserialization) — alternate edge-device entry path.
4. CVE-2023-21529 (Exchange deserialization) — post-access privilege escalation/internal pivot vector.
5. CVE-2026-48027 (Nx Console embedded malicious code) — developer-toolchain supply chain; possible secondary access vector against technology-sector victims.

Assessment: The most probable kill chain is Check Point VPN compromise (CVE-2026-50751) → MSP internal foothold → ScreenConnect/RMM abuse (CVE-2024-1708) → simultaneous downstream deployment across the client base.

Detection Engineering

The following detections target the TTP chain assessed above: edge exploitation, RMM abuse, lateral movement, staging, and pre-encryption behaviors.

---
title: BLACKNEVAS - RMM Tool Abnormal Outbound Connection (ScreenConnect/Rclone Exfil)
id: 8f3a2b71-4c5e-4d9a-b1f2-9e7c6a5d3b21
status: experimental
description: Detects RMM agents or data-transfer utilities (rclone, winscp, curl) making outbound connections to cloud storage or non-corporate infrastructure, consistent with BLACKNEVAS pre-encryption exfiltration via compromised MSP tooling.
author: Security Arsenal Threat Intelligence
date: 2026/08/13
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
      - '\screenconnect.clientservice.exe'
      - '\curl.exe'
      - '\screenconnect.windowsclient.exe'
  selection_dst:
    DestinationHostname|contains:
      - 'mega.nz'
      - 'mega.co.nz'
      - 'transfer.sh'
      - 'file.io'
      - 'anonfiles'
      - 'gofile.io'
  condition: selection_img and selection_dst
falsepositives:
  - Legitimate MSP file transfers via ScreenConnect (baseline per-source-host frequency)
  - Developer use of curl to known cloud endpoints
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1219
---
title: BLACKNEVAS - Pre-Encryption Staging (Shadow Copy Deletion and Recovery Disable)
id: 2b7c9d14-6e8f-4a3c-9d5b-1f4e8a6c2d17
status: experimental
description: Detects Volume Shadow Copy deletion, boot recovery disabling, and backup catalog tampering — the final pre-detonation step in BLACKNEVAS and related post-Conti lineage playbooks. High-fidelity when correlated within 15 minutes of mass file modification.
author: Security Arsenal Threat Intelligence
date: 2026/08/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains|all:
        - 'delete'
        - 'shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'bootstatuspolicy ignoreallfailures'
    - Image|endswith: '\wbadmin.exe'
      CommandLine|contains|all:
        - 'delete'
        - 'catalog'
  condition: selection_vss
falsepositives:
  - Rare; legitimate admin cleanup scripts should be allowlisted by hash and parent process
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: BLACKNEVAS - Lateral Movement via PsExec-Style Service or WMI from Single Source
title_note: MSP pivot detection
id: 5d1e6f82-9a4b-4c7d-8e3f-6b2a9c1d4e53
status: experimental
description: Detects remote service creation (PsExec/PAExec pattern) or WMI process spawning where the parent is an RMM agent, consistent with BLACKNEVAS deploying payloads downstream from compromised MSP management tooling.
author: Security Arsenal Threat Intelligence
date: 2026/08/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_rmm:
    ParentImage|endswith:
      - '\screenconnect.clientservice.exe'
      - '\ltsvc.exe'
      - '\agentmon.exe'
      - '\connectwisecontrol.exe'
  selection_child:
    Image|endswith:
      - '\psexec.exe'
      - '\paexec.exe'
      - '\wmiprvse.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
  condition: selection_parent_rmm and selection_child
falsepositives:
  - Routine MSP patch deployment — alert on NEW child process names not seen in trailing 30-day baseline per host
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1219

Microsoft Sentinel — MSP Pivot & Pre-Ransomware Staging Hunt

This KQL query hunts for the core campaign pattern: an RMM agent spawning unusual child processes, followed by staging or impact behaviors within a one-hour window on the same host.

// BLACKNEVAS hunt: RMM-spawned suspicious children + pre-encryption staging, 1h correlation window
let lookback = 7d;
let RmmParents = dynamic(["screenconnect.clientservice.exe","ltsvc.exe","agentmon.exe","connectwisecontrol.exe","ninjarmmagent.exe","syncro.service.exe"]);
let SuspiciousChildren = dynamic(["powershell.exe","cmd.exe","psexec.exe","paexec.exe","rclone.exe","winscp.exe","rundll32.exe","vssadmin.exe","wmic.exe","bcdedit.exe","net.exe","nltest.exe","adfind.exe"]);
let RmmSpawns =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName has_any (RmmParents)
    | where FileName has_any (SuspiciousChildren)
    | project SpawnTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, DeviceId;
let StagingOrImpact =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","bootstatuspolicy","delete catalog")
       or FileName in~ ("rclone.exe","winscp.exe")
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine, StageFile=FileName, DeviceId;
RmmSpawns
| join kind=inner StagingOrImpact on DeviceId
| where abs(datetime_diff('minute', StageTime, SpawnTime)) <= 60
| project DeviceName, AccountName, RmmSpawned=FileName, SpawnCmd=ProcessCommandLine, SpawnTime, StageFile, StageCmd, StageTime
| sort by StageTime desc

Rapid Response — Perimeter & Staging Sweep

Run this on any host managed by a third-party IT provider, and on your VPN/firewall adjacent servers. It checks for exposed RDP, recently created scheduled tasks (persistence), shadow copy tampering, and suspicious new local admins — the four fastest signals of a BLACKNEVAS-style intrusion in progress.

# BLACKNEVAS Rapid Triage Sweep - run elevated, review output before containment
$report = @{};
$cutoff = (Get-Date).AddDays(-7)

# 1. RDP exposure check
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$report['RDP_Enabled'] = ($rdp.fDenyTSConnections -eq 0)
$report['RDP_NLA_Enforced'] = ($nla.UserAuthentication -eq 1)

# 2. Scheduled tasks created in last 7 days (persistence / deployment)
$report['NewScheduledTasks'] = Get-ScheduledTask | Where-Object {
    (Get-ScheduledTaskInfo $_).LastRunTime -gt $cutoff -and
    $_.TaskPath -notlike '\Microsoft*'
} | Select-Object TaskName, TaskPath, @{N='Author';E={$_.Author}}

# 3. Shadow copy status — empty list on a server that should have them = tampering indicator
$report['ShadowCopies'] = (Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Measure-Object).Count

# 4. Local admins added in last 7 days (via event log)
$report['NewLocalAdmins'] = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Administrators' } | Select-Object TimeCreated, Message

# 5. Recent logons from unusual sources (type 10 = RDP, type 3 = network)
$report['RecentRemoteLogons'] = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Properties[8].Value -in 3,10 } |
    Group-Object { $_.Properties[18].Value } | Sort-Object Count -Descending | Select-Object Count, Name -First 10

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "[+] Triage written to $env:TEMP. Red flags: RDP without NLA, shadow copies = 0, unknown scheduled tasks, unfamiliar logon source IPs." -ForegroundColor Yellow

Incident Response Priorities

T-minus detection checklist (pre-encryption)

If you are a downstream MSP client and see any two of the following, assume detonation is imminent and move to containment immediately:

• RMM agent (ScreenConnect or similar) spawning cmd/PowerShell outside a known maintenance window
• vssadmin delete shadows, bcdedit ... recoveryenabled no, or wbadmin delete catalog execution
• Rclone, WinSCP, or curl processes with cloud-storage destinations
• New scheduled tasks or services created by the MSP management account
• Mass file reads against file servers/SharePoint in off-hours (exfil staging)
• EDR/AV tampering attempts (service stops, exclusion additions) executed under the RMM service account

Assets this gang historically prioritizes for exfiltration

• Finance: AR/AP exports, payroll, banking details (leverage for payment pressure)
• Legal/regulated data: client contracts, PHI-adjacent records (note the healthcare victim), customs/trade documentation (note the brokerage victim)
• Identity stores: Active Directory database (ntds.dit), credential vault exports from the MSP's own systems
• MSP-specific: the provider's RMM configuration, client lists, and stored credentials — these become the lever against every downstream customer

Containment actions, ordered by urgency

1. Isolate the MSP trust path first: disable/suspend inbound connections from MSP RMM tooling at the firewall and revoke MSP service-account credentials. Do this before host isolation — the RMM channel is the re-entry vector.
2. Block edge re-entry: force-reset VPN concentrator sessions, apply emergency patches for CVE-2026-50751 (Check Point) and CVE-2026-20131 (Cisco FMC), or take the appliance to passive/monitor mode.
3. Isolate affected hosts at the network layer (switch/EDR quarantine) — do not power off (preserves memory artifacts and intermittent-encryption forensics).
4. Rotate all credentials the MSP could have touched: domain admin, service accounts, local admins (LAPS re-rotation), cloud tenant app secrets.
5. Snapshot and preserve volatile evidence: RMM logs, VPN concentrator logs, EDR telemetry for the full dwell window (minimum 14 days back).
6. Engage IR retainer and legal/comms before any ransom contact; leak-site negotiation with a multi-victim bundle in play changes disclosure obligations per downstream client.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV edge CVEs now: CVE-2026-50751 (Check Point IKEv1 auth bypass), CVE-2026-20131 (Cisco FMC deserialization), CVE-2024-1708 (ScreenConnect). If patching is blocked, disable IKEv1 / restrict management interfaces to allowlisted IPs.
• Audit your MSP relationship: enumerate every RMM agent in your environment (the KQL above doubles as an inventory), confirm which accounts they run as, and enforce MFA + conditional access on all MSP interactive access.
• Disable macro execution from internet-sourced Office files (Mark-of-the-Web policy) and block ISO/IMG mounting for standard users.
• Enforce NLA + MFA on RDP; better, remove direct RDP exposure entirely and broker through a gateway or ZTNA.
• Protect shadow copies: restrict vssadmin/bcdedit/wbadmin execution via WDAC/AppLocker for non-admin contexts and enable tamper protection on EDR.

Short-term (2 weeks)

• Architectural isolation of third-party management: RMM tooling must live in a dedicated VLAN/segment with explicit allowlisting; MSP access should be just-in-time with session recording, not standing.
• Deploy the Sigma rules above through your SIEM pipeline and establish 30-day baselines for RMM child-process behavior — the single highest-value detection for this threat class.
• Implement egress filtering on cloud storage endpoints (MEGA, GoFile, transfer.sh) for server and workstation subnets; exfil is the extortion lever, and blocking it collapses the double-extortion model.
• Tiered backup architecture: immutable/offline copies with a separately authenticated control plane, plus quarterly restoration drills. Ransomware crews delete what they can reach; make recovery unreachable for them.
• Vendor risk review: require MSPs to attest to patch SLAs on their own edge devices and RMM infrastructure — this campaign exists because an IT provider's perimeter failed first.

Intelligence sourced from live dark web leak-site monitoring. Victim names are published as observed on the threat actor's infrastructure; inclusion does not confirm the victim's own disclosure status. Detection content is provided under Security Arsenal's threat-intelligence sharing policy — test before production deployment.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub