Nova is a ransomware group that operates a Ransomware-as-a-Service (RaaS) model to extort organizations through file encryption and data theft. Nova equips affiliates with a Rust-based encryptor and threatens to publish stolen information on a dedicated Dark Web leak site. With victim claims spanning multiple industries and countries, the group threatens organizations well beyond a single sector or region. The group first surfaced as RALord in March 2025 and rebranded as Nova the following month.
Who Is Nova Ransomware (Formerly RALord)?
Nova is a financially motivated ransomware group that recruits affiliates, supplies encryption tools, and uses stolen data to extort organizations. After the rebrand, Nova carried existing RALord victim listings onto the renamed leak site and added affiliate registration and communication channels.
Nova claims that its members had taken part in other, unnamed ransomware groups in 2018 and 2020. Although unverified, this account suggests that the Nova brand may be newer than the individuals behind it. The group names financial gain as its primary motive and says it selects victims based on exploitable weaknesses, not industry.
Nova advertises several ways for other threat actors to participate:
- RaaS affiliate program: Early RALord advertisements offered affiliates 85% of ransom proceeds, and Nova advertised a 90% share in June 2025. Both figures reflect advertised terms, not verified payments.
- Encryption-tool access: Nova offers access to its ransomware tools separately from the affiliate program.
- Stolen-data sales: The group advertises stolen information for sale, adding another way to profit from compromised organizations.
From RALord to Nova Ransomware
RALord is the name under which the group first appeared in March 2025, running its own leak site and affiliate advertisements. RA World is a separate and older ransomware operation, active since 2023 after first emerging as RA Group. The shared “RA” prefix makes the two easy to confuse, which is why Nova’s own account of their relationship matters.
The group adopted the Nova name in April 2025. In a June 2025 interview, the threat actors claimed that they had changed the name after rejecting an approach from RA World, which they said had sought to join them. This explanation remains unverified, and it does not support treating Nova as an RA World successor. Linking the two without further evidence risks conflating separate threat actors and misreading the group’s history.
Nova uses a Rust-based encryptor, but claims linking the ransomware to leaked Babuk source code remain unconfirmed. Neither the RALord name nor Nova’s claimed contact with RA World establishes shared membership, infrastructure, or code.
What Are the Targets of Nova Ransomware?
Nova describes any company it considers vulnerable as a potential victim, and its leak site reflects that broad approach. SOCRadar Threat Intelligence tracked 177 organizations named on the site between April 2025 and July 2026, spanning 45 countries and 10 industry sectors. The latest posting appeared in July 2026. This distribution suggests that opportunity, not a fixed geographic or industry preference, drives Nova’s target selection.
The 10 most frequently listed countries account for 55.4% of Nova’s claimed victims. The remaining 44.6% span 35 countries, a geographic reach well beyond a small cluster of national markets.
No Commonwealth of Independent States (CIS) country appears among the top 10. However, this absence does not show that Nova avoids attacking organizations in the region.
Technology and manufacturing together account for approximately 45% of Nova’s claimed victims. Government and defense organizations represent another 5.6%, showing that Nova also targets the public sector.
Nova’s leak-site activity increased sharply in mid-2026:
- 74 claimed victims appeared between May and July 2026.
- Those three months account for 41.8% of all claims tracked during the collection period.
The increase reflects a surge in public victim disclosures. Posting dates do not necessarily match when the underlying attacks occurred.
What Are the Techniques of Nova Ransomware?
Nova combines ransomware deployment, data theft, and public disclosure threats to extort organizations. The group’s advertisements describe how affiliates supply network access, while malware analysis documents techniques for weakening security controls, obstructing recovery, and encrypting files. Early RALord samples and later Nova builds differ, so findings from one sample do not automatically apply to every attack.
Initial Access and Affiliate Responsibilities
Nova asks affiliates to provide validated access to compromised networks and to extract sensitive information before ransomware deployment. The group advertises additional charges for data extraction and hosting when affiliates have not completed those steps.
These instructions describe a division of responsibilities, not how affiliates obtain access. Available evidence does not identify a consistent Nova-specific entry vector.
Execution and Anti-Analysis
Nova’s analyzed Windows encryptor contains Rust standard-library paths and Cargo dependency references, which identify it as a Rust-based executable.
[Screenshot placeholder: replace the SonicWall image with the Nova sample’s ANY.RUN or MalwareBazaar page]
An early RALord sample examined in SonicWall’s research opened a console window and scanned files for encryption. The sample also attempted to encrypt its own executable, revealing a flaw in that build.
A later Windows build checks for a debugger, enumerates running processes, and terminates itself when it detects specified reverse-engineering, debugging, or monitoring tools. These behaviors align with Debugger Evasion (T1622) and Process Discovery (T1057).
Defense Evasion
The later analyzed build uses PowerShell, registry changes, and service manipulation to interfere with endpoint protection. Nova attempts to:
- Disable Microsoft Defender protections and add drive-wide scan exclusions.
- Stop security services and terminate processes associated with antivirus (AV) and endpoint detection and response (EDR) products.
- Clear Windows Event Logs across multiple channels to reduce the evidence available to investigators.
Whether these actions succeed depends on permissions, host configuration, and protection settings.
Nova Ransomware Development
In an April 4, 2025 announcement for “Nova 1.0,” the threat actors claimed to have corrected weaknesses identified in published research and to have added anti-analysis and detection-evasion features. The post appeared under RALord branding, showing that the Nova name already featured in ransomware updates during the transition.
Nova also claims to maintain five locker types, including versions for different privilege levels, a Linux variant, and a boot locker. These are advertised capabilities, not features verified across all variants.
Data Theft and Extortion
Nova advertises both encryption-only attacks and double extortion. Double extortion combines file encryption with data theft and hosting, letting the threat actors pressure victims through both disruption and threatened disclosure.
The group’s instructions separate data extraction from ransomware deployment but do not name the tools, transfer protocols, or storage providers used for exfiltration. Nova’s double-extortion model therefore does not point to a specific exfiltration technique.
Recovery Inhibition
The analyzed Windows build enumerates logical drives through Windows Management Instrumentation (WMI) and deletes Volume Shadow Copies using vssadmin and wmic. This behavior aligns with Inhibit System Recovery (T1490) and blocks recovery through Windows shadow copies.
Encryption and Ransom Notes
The later analyzed Rust build uses XChaCha20-Poly1305 for file encryption and RSA-2048 to protect encryption keys. Encrypting victim files corresponds to Data Encrypted for Impact (T1486).
File extensions and ransom-note names differ between samples:
- Early RALord sample: Appends .ralord and creates a README text file with a randomized filename suffix. The note directs victims to negotiate through qTox without specifying a fixed ransom amount.
- Later Nova sample: Appends .xgWLckNV and drops a ransom note named README_NOVA.me.
The later sample also deletes its own executable after encryption. These differences make extensions and note names useful sample artifacts, but not reliable identifiers for every Nova build.
How Can Organizations Defend Against Nova Ransomware?
Nova’s tradecraft is opportunistic rather than novel, so the controls that blunt it are the same ones that blunt most RaaS operations. The measures below follow the tactics, techniques, and procedures (TTPs) described above, ordered by where they interrupt the intrusion chain.
Restrict External Access Points
Nova depends on affiliates to deliver validated network access, even though no consistent entry vector has been identified. Enforce multi-factor authentication (MFA) on all virtual private network (VPN) and Remote Desktop Protocol (RDP) access, and disable internet-facing RDP where it is not strictly required. Rotate credentials that may have appeared in credential-stuffing campaigns or initial access broker (IAB) listings.
Protect Backup and Recovery Capability
Nova’s analyzed builds delete Volume Shadow Copies, so shadow copies alone cannot serve as a recovery path. Maintain offline or immutable backups that the production network cannot reach, and test recovery procedures regularly. Backups do not neutralize the threat of data disclosure, but they remove ransom payment as the only path to operational recovery.
Extend Coverage Beyond Windows Endpoints
Nova advertises a Linux variant and a boot locker, and third-party reporting describes VMware ESXi payloads. Extend EDR coverage to Linux hosts and hypervisor management interfaces, not just the Windows workstations and servers that legacy EDR deployments often prioritize.
Monitor for Defense Evasion Indicators
Alert on unauthorized changes to Microsoft Defender policy, real-time protection settings, or scan exclusions, whether made through PowerShell or written directly to the registry. Alert on bulk Volume Shadow Copy deletion and mass clearing of Windows Event Logs, both of which precede encryption in the analyzed execution flow. Baseline anomalous PowerShell and command-line activity outside expected administrative windows.
Third-party reporting also describes bcdedit commands that force Safe Mode with Networking before encryption in some Nova intrusions. Alert on unauthorized boot configuration changes made through bcdedit.
Harden EDR Against Tampering
Enable tamper protection on endpoint security products and alert on service-level attempts to stop or disable them. Nova’s analyzed builds terminate protection components from a range of major AV and EDR vendors rather than target a single product.
Control Remote Access Tooling
Maintain an allowlist of approved remote access software and alert on unauthorized installation or execution of tools such as PuTTY, AnyDesk, or LogMeIn. Third-party reporting indicates that Nova affiliates have used these tools for lateral movement and persistence.
Integrate Dark Web and Threat Intelligence Monitoring
Because Nova affiliates must arrive with validated access, exposed credentials and access listings are an early warning sign. Continuous monitoring of Dark Web marketplaces and leak sites for exposed corporate credentials, VPN access listings, and data leak site (DLS) postings naming your organization can shorten the time between compromise and detection. SOCRadar Threat Intelligence’s Advanced Dark Web Monitoring (ADWM) module provides this coverage. SOCRadar’s Threat Actor Intelligence module complements this by tracking Nova’s leak-site postings, claimed victims, and activity trends in a single view.
What Are the MITRE ATT&CK TTPs of Nova Ransomware?
The table below consolidates Nova’s techniques with their current MITRE ATT&CK identifiers. The Basis column shows whether each mapping comes from analyzed samples, from Nova’s own advertisements, or from third-party reporting.
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Valid Accounts | T1078 |
| Initial Access | Exploit Public-Facing Application | T1190 |
| Initial Access | Phishing: Spearphishing Attachment / Link | T1566.001, T1566.002 |
| Execution | Command and Scripting Interpreter: PowerShell | T1059.001 |
| Execution | Command and Scripting Interpreter: Windows Command Shell | T1059.003 |
| Persistence | Boot or Logon Autostart Execution: Registry Run Keys | T1547.001 |
| Persistence | Scheduled Task/Job: Scheduled Task | T1053.005 |
| Defense Evasion | System Binary Proxy Execution | T1218 |
| Defense Evasion | Safe Mode Boot | T1562.009 |
| Defense Evasion | Impair Defenses: Disable or Modify Tools | T1562.001 |
| Defense Evasion | Indicator Removal: Clear Windows Event Logs | T1070.001 |
| Defense Evasion | Debugger Evasion | T1622 |
| Discovery | Security Software Discovery | T1518.001 |
| Command and Control | Remote Access Tools: Remote Desktop Software | T1219.002 |
| Lateral Movement | Remote Services: SSH | T1021.004 |
| Exfiltration | Exfiltration Over Web Service | T1567 |
| Impact | Data Encrypted for Impact | T1486 |
| Impact | Inhibit System Recovery | T1490 |
What Are the IOCs of Nova Ransomware?
For indicators of compromise (IOCs) associated with Nova Ransomware, visit the threat actor profile on the SOCRadar platform.
Source: SOCRadar · 2026-11-05