Blacknevas Claims Theft of 1 TB of Data from Arkın Group
Summary
A ransomware.live monitoring post records blacknevas's unconfirmed claim that it stole more than 1 TB of data from Arkın Group properties in Turkey. The post also links the intrusion to CryptoRex, leaving the actor attribution unresolved.
Key points
- The post attributes an unconfirmed claim of more than 1 TB of stolen data from Arkın Group, its casino, and three properties in Turkey to blacknevas.
- The claimed access path was a compromised reservations employee account, followed by use of remote administration tools to expand access and bypass segmentation.
- The reported data includes guest, booking and payment records; staff CRM notes; casino player and fund-movement records; and passport and KYC/AML documents.
- The post says some archives appeared on underground forums and that data was offered for auction starting at 8 bitcoins; these claims are unverified.
- The article also says analysts link the intrusion to CryptoRex, conflicting with its attribution of the claim to blacknevas.
- The post reports that Arkın Group had not publicly responded, online booking was temporarily unavailable, and authorities had begun consultations with EU experts.
Article Details
- Victim
- Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach
- Encryption Status
- Unknown
- Exfiltration Status
- Reported in claims attributed to blacknevas; the article states the information is unverified and does not confirm the incident.
- Exfiltrated Data
- Reportedly includes guest profiles, booking and payment information, staff CRM notes, casino player records, chip exchange and fund movement logs, and scanned passports with KYC/AML documents. The article says some archives appeared online, but does not confirm their authenticity.
- Exfiltrated Size
- Over 1 TB, as reported in the article; unverified.
- Ransom Demand
- Not disclosed. The reported auction starting at 8 bitcoins concerns resale of stolen data, not a stated ransom demand.
- Leak Status
- Parts of the archive were reportedly appearing on underground forums and darknet marketplaces and offered for auction; the claims and data authenticity are unverified.
Threat Actors
blacknevasThe article attributes public claims about the breach to blacknevas and describes it as the alleged ransomware group. The incident and claims are not independently confirmed in the article.CryptoRexThe article says security analysts link the intrusion to CryptoRex, but provides no supporting details and does not confirm the attribution.