RALord

RALord is a ransomware family also referenced in later reporting as NOVA, with reporting describing Nova as a ransomware-as-a-service operation that distributes or operates the RALord/RaLord ransomware. The malware is associated with double extortion: encrypting files, exfiltrating sensitive data, and threatening public leaks to pressure victims. Reporting states Nova/RALord encryptors are written in Rust. Observed encrypted file extensions include .RALord, .ralord, and in Nova-linked reporting .RNOVA. Reported ransom note naming includes README-[random_string].txt and README-Nova. Victims are directed to communicate via private messengers such as Tox or Session, and the operators reportedly prefer negotiated payments over fixed-payment instructions. The group has been described as targeting multiple sectors including healthcare, IT, manufacturing, telecom, education, and construction. Public reporting cited in the content places Nova/RALord activity beginning in or being publicly discussed in April 2025, with ransomware.live reporting 37 Nova victims since surfacing in April 2025; other reporting characterizes RALord as a lower-volume group with incident counts in the single digits. The content links Nova/RALord to a July 2025 attack on Dutch medical lab Clinical Diagnostics, where stolen patient data was threatened for leak, and to an incident involving Eriell Group in which a Nova affiliate reportedly made an erroneous targeting decision. The content also states that RaLord/RALord is considered a successor or offshoot of the former RA Group. No credible evidence of nation-state linkage is provided in the content; instead, the operation is characterized as financially motivated criminal ransomware.