ransomware

Nova

active · last signal 2mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

RALordNova RaaSRALord/Nova

Attribution

This profile covers the NOVA RANSOMWARE operation (RaaS), which emerged as RALord in March 2025 and rebranded to Nova in April 2025. It is explicitly NOT the unrelated 'Nova Stealer' (a NovaSentinel/SnakeStealer-family infostealer sold on Telegram), and not the Babuk-derived generic 'Nova' label some vendors use loosely. Note: 'Nova' is a heavily reused name; the RALord->Nova cluster is the double-extortion RaaS profiled here. Some reporting speculates Nova's encryptor may reuse leaked Babuk source, but this lineage is unconfirmed. Operator nationality is unknown.

First seen

2025-03

Last active

2026-01

Motivation

Financial (double-extortion ransomware-as-a-service)

Attribution confidence

medium

MENA targeting

UAE, Saudi Arabia

Sectors

Transportation, manufacturing, energy/utilities

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE, Saudi Arabia (Transportation, manufacturing, energy/utilities sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BrainCipheractorTechnique overlap
DireWolfactorTechnique overlap
Cicada3301actorTechnique overlap
SinobiactorTechnique overlap
LynxactorTechnique overlap
DevmanactorTechnique overlap
Hunters InternationalactorTechnique overlap
TrigonaactorTechnique overlap
Everestactor

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Nova's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

8 / 13

Mean robustness (of covered)

2.1

Claimed victims · 3 tracked

Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →

Claim volume · last 12 months

ONDJFMAMJJAS

Useful?

Date	Victim	Country	Sector
2026-07-19	meralmanisa	Türkiye	Manufacturing
2026-06-20	Dosab	Saudi Arabia	Manufacturing
2026-05-24	Adensa Teknoloji	Türkiye	Technology