Blacknevas claims to have breached MST (Sanko Makina and ASKO Holding) in Turkey, stolen a significant volume of data over seven months, and encrypted the files in secure storage. The ransom note demands a starting price of 15 bitcoins for decryption of the stolen data and notes MST’s close ties to Turkey’s defense industry.
#Turkey
#Turkey
Incident Details
- Victim: The company MST (Sanko Makina and ASKO Holding)
- Sector: Manufacturing
- Country: TR
- Actor: blacknevas
- Source: http://ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion/b0d5c3ac-d2f9-4e6c-97d0-a49255c54de0
- Discovered: 2026-04-30T23:18:19.969621+00:00
- Published: 2026-03-17T14:04:06+00:00
Information
- The company MST (Sanko Makina and ASKO Holding) has direct and close ties to the Turkish defense industry and supplies specialized military engineering equipment.
- Production of armored construction equipment: armored backhoe loaders and telehandlers with cabins, engine compartments, and vital components protected against small arms fire and IED blasts.
- Primary customers include the Turkish Armed Forces (TSK), the General Command of the Gendarmerie, and the General Directorate of Security (Police).
- Specific applications by engineering troops and special forces: digging trenches and building defensive berms on the front lines.
- Specific applications: dismantling barricades, destroying militant shelters, and clearing streets during anti-terrorist urban operations (notably used in southeastern Turkey).
- Specific applications: safely neutralizing explosive devices on roads.
- Specific applications: constructing and fortifying military outposts and bases.
- Integration into state defense programs through close cooperation with the Presidency of Defense Industries (SSB) as part of Turkey’s import substitution and national-supply strategy.
- Regular participation in international defense exhibitions (e.g., IDEF), offering armored special equipment for domestic use and export to allied nations.
- Actor responsible: blacknevas.
- Over the course of seven months, a significant volume of data was stolen.
- The obtained files were encrypted and stored in secure storage.
- The stated starting price is 15 bitcoins.
Disclaimer: This post is based on public claims made by the ransomware group "blacknevas". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.