Nova ransomware expands extortion with data theft and leaks

Nova Ransomware operates as a ransomware-as-a-service (RaaS) group, supplying affiliates with a Rust-based encryptor and threatening to publish stolen data on a dedicated dark web leak site. The operation first appeared as RALord in March 2025 and rebranded as Nova the following month. Nova describes itself as financially motivated, recruiting affiliates, offering encryption tools, and monetising via stolen-data sales in addition to extortion.

Advertised terms include an 85%–90% affiliate share of ransom proceeds, with 90% cited in June 2025, though those figures are promotional rather than evidence of payments. The group’s leak-site activity spans 177 named victims across 45 countries and 10 sectors between April 2025 and July 2026, with a notable surge in disclosures from May to July 2026.

Technical analysis indicates a Rust-based encryptor and a multi-faceted extortion model combining encryption with data theft and public disclosure. Early RALord samples showed a plaintext-encrypting console and an attempt to encrypt their own executable, while later Nova builds include anti-analysis checks ( debugger detection, process enumeration) and defence evasion tactics such as disabling Defender, creating scan exclusions, stopping AV/EDR services, and clearing Windows Event Logs.

The later builds employ PowerShell, registry changes, and service manipulation, with encryption using XChaCha20-Poly1305 and RSA-2048 to safeguard keys; file extensions include .xgWLckNV and ransom notes named README_NOVA.me, with some samples deleting themselves post-encryption. Nova’s double-extortion model adds coercion through data theft and hosting, but the article notes that exfiltration tools and protocols are not named.

MITRE ATT&CK mappings are provided, linking Nova techniques to categories such as Initial Access, Defense Evasion, and Impact. IOCs are available on SOCRadar’s threat actor profile.