blacknevas ransomware group lists The company MST (Sanko Makina and ASKO Holding) on its leak site

• Ransomware group: blacknevas
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: April 30, 2026

The company MST (Sanko Makina and ASKO Holding) has been listed on a leak site by the ransomware group known as blacknevas. According to the announcement made on April 30, 2026, the threat actor claims to have compromised sensitive information belonging to the organization. This incident follows a period of alleged unauthorized access that the group claims spanned seven months, starting around March 17, 2026.

The claims made by blacknevas

The threat actor known as blacknevas has announced that it has successfully compromised data belonging to the company MST (Sanko Makina and ASKO Holding). The group asserts that the exfiltration process was not a singular event but rather a prolonged operation that spanned a seven-month period. This long-term presence within a network is a tactic often used by sophisticated actors to avoid detection while systematically gathering valuable information.

In relation to this alleged breach, the group has issued a ransom demand. The threat actor is demanding a payment of 15 BTC in exchange for the stolen data. While the exact volume of the data and the specific number of files involved have not been specified by the group, the announcement indicates a significant breach of the organization's digital perimeter.

Details regarding the leaked data

The exact scope and total volume of the leaked data have not been explicitly defined in the group's announcement. However, the group has provided evidence to support its claims through the release of screenshots. These visual samples suggest that the stolen information includes various types of sensitive corporate documentation. Based on the available evidence, the following types of data are represented in the samples:

• Corporate reports
• Production data
• Operational documents

The presence of such documents suggests that the breach may impact the internal administrative and manufacturing workflows of the organization. It is important to note that the group has not provided a specific file count or a total data size for the exfiltrated information.

About MST (Sanko Makina and ASKO Holding)

MST Construction and Agricultural Machinery operates under the umbrella of Sanko Holding. The company is a significant player in the manufacturing sector, specializing in the production of construction machinery and agricultural equipment. Beyond standard manufacturing, the company is particularly recognized for its specialized engineering capabilities, specifically in the development of armored construction machinery and specialized engineering equipment designed for the defense industry.

Analysis and potential implications

This incident may pose a significant risk to the operational security of a company with close ties to the defense industry. Because the organization is involved in military-related projects, the leak may carry sensitivities regarding national security. The public disclosure of stolen data in such a context could lead to the exposure of highly sensitive trade secrets and a potential compromise of broader supply chain security.

Furthermore, the nature of the attack and the ransom demand suggest a risk of double extortion. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's data but also steal it, threatening to leak it publicly if the ransom is not paid. This adds a layer of pressure on the organization, as the threat of data exposure remains even if systems are restored from backups.

From a regulatory perspective, the breach may trigger legal processes regarding data protection regulations, such as the KVKK. Organizations operating in high-stakes sectors like manufacturing and defense must prioritize robust cybersecurity frameworks to mitigate these risks. General defensive steps for organizations in this sector often include implementing strict access controls, continuous network monitoring to detect long-term exfiltration, and ensuring comprehensive encryption for both data at rest and data in transit to protect sensitive engineering and production information.