Nova

Nova, formerly known as RALord, is a ransomware-as-a-service operation first observed in 2025. It is associated with double-extortion activity in which affiliates steal data and encrypt victim systems, then pressure organizations through leak-site publication and ransom negotiations. Reporting links the ransomware to Babuk-derived code and describes cross-platform payloads written in Rust for Windows, Linux, and VMware ESXi environments. Nova has been observed targeting organizations across multiple sectors, including healthcare, education, professional services, hospitality, IT services, media, construction, and agriculture, with victim claims spanning multiple regions.

Nova’s intrusion model includes several common enterprise compromise paths. Initial access has been associated with compromised VPN or RDP credentials, credential stuffing and password reuse, purchases from initial access brokers, exploitation of public-facing applications, and spearphishing disguised as legitimate business communications. After access, affiliates conduct system and network discovery, harvest credentials, move laterally through administrative protocols and remote management mechanisms, and target backup infrastructure to inhibit recovery. Reported tradecraft includes use of PowerShell and command interpreters, credential dumping from LSASS, theft of browser and credential-store data, use of legitimate remote administration tools, and propagation to virtualized environments including ESXi.

Defense evasion and impact techniques attributed to Nova include terminating security and backup processes, deleting shadow copies, modifying boot settings to force Safe Mode with Networking before encryption, and using multiple payload variants and extensions. The ransomware is reported to encrypt files with symmetric encryption protected by public-key cryptography, while exfiltrating large volumes of data before deployment of the locker. Nova also operates leak and negotiation infrastructure to support affiliate operations and victim communications.

Nova has been publicly described as aggressively recruiting affiliates on criminal forums and offering favorable revenue sharing and low-cost locker access. The operation has been tied to attacks and claims affecting healthcare and education institutions, including incidents in the Netherlands and South Korea, and has appeared in ransomware victim tallies during 2025 and 2026. Public reporting also notes an operational link between Nova and the broader RALord network, including a rebranding from RALord to Nova shortly after initial emergence.