RANSOMWARE VICTIM

Trojan Construction & Holding Group www.trojan.ae

blacknevas📅 October 27, 2025
8
same group

Attack Intelligence

Trojan Construction & Holding Group www.trojan.ae was compromised in a ransomware attack attributed to blacknevas in October 2025. The organization, operating in an undisclosed sector in Unknown, was added to the group's data leak site as part of an extortion campaign.

blacknevas operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Over 3 terabytes of project and financial reporting data for 2024–2025. https://gofile.io/d/4Uf42V For an example of what data we have and sell at a high price, please write to us if you are interested: Qualitydatarecovery@mail.comTrojan Holding is an Abu Dhabi-based construction company founded in 2012. It is a diversified group of companies engaged in a wide range of construction projects, including high-rise buildings, hospitals, schools, resorts, and residential complexes. The company is a leader in the construction sector in the UAE and the region, with a large project portfolio and is a subsidiary of Alpha Dhabi Holding.The Group currently has eight subsidiaries:Trojan General Contracting,National Projects & Construction,Royal Advance Electromechanical Works,Reem Emirates Aluminum,Hi-Tech Concrete Products,Al Maha Modular Industries,Phoenix Timber Factory andReem Readymix.

Other Victims — blacknevas (8)

Quick Facts

Attack DateOct 27, 2025
Intel Sourceransomlook

Threat Group

blacknevas
Motivation: financial
View group profile →

External Links

Data sourced from Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Victim listing does not imply confirmed breach — intelligence based on group claims.