Trojan Construction & Holding Group targeted by Blacknevas ransomware group

• Ransomware group: Blacknevas
• Country: United Arab Emirates
• Sector: Manufacturing
• Announcement date: October 27, 2025

Blacknevas claims responsibility for Trojan Construction & Holding Group data breach

The threat actor known as Blacknevas has listed data allegedly belonging to Trojan Construction & Holding Group on their leak site. According to the announcement made on October 27, 2025, the group claims to have obtained a significant volume of sensitive information. The group asserts that the stolen data consists of 3 terabytes of project and financial reporting data covering the years 2024–2025. The announcement includes an external link providing data samples and an email address for further communication.

Details of the claimed data theft

The contents of the leak announcement are extensive, involving various types of corporate and personal documentation. The threat actor claims to have accessed files that could impact both the operational and administrative functions of the organization. The specific types of data mentioned in the leak include:

• Project reports
• Financial data
• Technical drawings
• Employee identity information

The information reportedly includes project reports, financial documents, and technical drawings dating from 2024 to 2025. Furthermore, the leak contains an image of a United Arab Emirates resident identity card belonging to an employee, which highlights the potential exposure of personally identifiable information (PII).

About Trojan Construction & Holding Group

Trojan Construction & Holding Group is a leading construction company based in Abu Dhabi, established in 2012. A subsidiary of Alpha Dhabi Holding, the group operates across a wide range of projects, including high-rise buildings, hospitals, schools, and residential complexes.

Analysis and potential impact of the incident

This incident suggests that sensitive corporate data and personal employee information within Trojan Construction & Holding Group may be at risk of exposure. The inclusion of employee identity card samples in the leak could indicate that staff members may be vulnerable to identity theft and targeted phishing attacks. Such attacks often leverage stolen personal details to gain further access to corporate networks or to defraud individuals.

The disclosure of trade secrets and details regarding ongoing projects within the construction sector may lead to a loss of competitive advantage and potential breaches of contractual obligations. Furthermore, the organization may face legal sanctions under UAE data protection regulations. Information regarding the Blacknevas group is limited; it is assessed that the group may be employing double-extortion tactics.

Double-extortion is a common tactic used by modern ransomware groups. In this scenario, attackers do not just encrypt a victim's data to demand a ransom for the decryption key; they also steal sensitive information before the encryption process begins. The attackers then threaten to leak the stolen data on public forums or leak sites if the ransom is not paid. This creates a secondary layer of pressure on the victim, as the threat of reputational damage and regulatory fines becomes a powerful motivator for payment.

For organizations operating in the construction and manufacturing sectors, protecting technical drawings and project reports is critical to maintaining a competitive edge. The loss of such intellectual property can undermine long-term business strategies and client trust. To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust access controls to ensure that only authorized personnel can view sensitive project files, as well as comprehensive encryption for data both at rest and in transit. Regular security awareness training is also vital to help employees recognize phishing attempts that may use stolen identity information to compromise the network. Additionally, maintaining strict compliance with regional data protection laws helps ensure that the organization is prepared for the legal complexities that arise following a data breach.