Description Summary
Nova (formerly RALord) is a ransomware-as-a-service (RaaS) group that encrypts victims’ files and uses double-extortion tactics to pressure organizations into paying for decryption and data non-disclosure.
Threat Actor
RaaS (85% affiliate); direct rebrand of RALord; claims to avoid schools/nonprofits.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
XChaCha20-Poly1305 + RSA-2048 (Rust; reportedly Babuk-based)
Ransom Note Name
Not publicly reported
Targeted Industries
Municipalities, Aerospace, NGOs
First Seen
Early 2025 as RALord → Nova April 2025
Last Seen
Active (73+ victims since May 2025)
Geographical Location
US, France, Brazil, Singapore
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |