Verified intelligence from authoritative sources does not identify a distinct threat actor group formally named 'nevada'. The term 'Nevada ransomware' or 'Nevada group' in public reporting primarily refers to the perpetrators of a significant ransomware attack against the State of Nevada in 2025, which some experts speculate could be linked to groups like Scattered Spider, Lapsus$, or ShinyHunters. The primary motivation for this activity was financial extortion, characteristic of ransomware operations. The defining aspect of this incident was the use of sophisticated initial access techniques, specifically leveraging SEO poisoning and malicious advertisements to deliver malware, and the subsequent prolonged undetected presence within the network before ransomware deployment.
Tecnicas MITRE
T1490, T1486, T1078, T1059.001
RansomLook pivots
Data, inteligencia y referencias externas para contrastar actividad ransomware del actor.
ChinaGermanyFinlandFranceUnited KingdomHungaryItalyUnited States
Sectores objetivo (SOCRadar)
Construction of BuildingsMonetary Authorities-Central BankCredit UnionsManufacturingConstructionPublic AdministrationEducational ServicesData Processing ServicesInsuranceComputer Systems Design and Related Services