Skip to navigation

Threat reportRansomwareTL-2026-5320

Nova (formerly RALord) Ransomware-as-a-Service Group

highACTIVE

Nova, formerly RALord, is a Rust-based ransomware-as-a-service operation active since March 2025 that combines file encryption with data theft (double extortion) for financial gain. Public trackers count roughly 120-180 claimed victims across dozens of countries, and the group recruits affiliates on an 85/15 revenue split. First disclosed .

Key facts for Nova RaaS ransomware

IdentifiersTL-2026-5320
Also known asRALord, Nova, Nova RaaS, RaLord ransomware
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows; Various Linux, NAS, FreeBSD, VMware ESXi and ARM-based systems
AttributionNova, RALord (low confidence)
MalwareGAV:RALord.RSM (Trojan), Mirai (ELF), RALord, nova
ToolsqTox
MITRE ATT&CK techniquesT1021.001 Remote Services: Remote Desktop Protocol, T1021.002 Remote Services: SMB/Windows Admin Shares, T1047 Windows Management Instrumentation, T1057 Process Discovery, T1059.001 Command and Scripting Interpreter: PowerShell, T1070.004 Indicator Removal: File Deletion, T1078 Valid Accounts, T1082 System Information Discovery, T1112 Modify Registry, T1133 External Remote Services, T1489 Service Stop, T1490 Inhibit System Recovery and 4 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, health, manufacturing, education, professional-services, hospitality, government administration, energy
Target regionsNorth America, Europe, 005 - South America, Asia, Middle East
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Nova RaaS ransomware

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5320 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Nova/RALord Ransomware Encryption Artifacts (.ralord Extension and README Ransom Notes)

Detects the file-system footprint of the Rust-based Nova (formerly RALord) encryptor tracked as TL-2026-5320: files carrying the .ralord extension and README-<random suffix>.txt ransom notes (containing a qTox contact ID) written in bulk by one process on one host. Five or more distinct artifact paths inside 10 minutes indicates active encryption rather than a single stray file, and distinct_dirs shows how many directories the encryptor walked (file and directory discovery, T1083), so a high value means broad traversal of the file system or shares. Later Nova builds may change the extension, so the ransom-note branch provides the fallback.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1486, T1083
  • Data sources: sysmon
  • Severity: critical
  • Confidence: high

Splunk SPL

```Nova/RALord TL-2026-5320 encryptor artifacts: .ralord extension and README-suffix.txt ransom notes```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h
| eval tfn=lower(TargetFilename)
| eval artifact=case(like(tfn,"%.ralord"),"ralord_extension", like(tfn,"%readme-%.txt"),"ransom_note")
| where isnotnull(artifact)
| eval dir=mvjoin(mvindex(split(TargetFilename,"\\"),0,-2),"\\")
| bin _time span=10m
| stats dc(TargetFilename) as distinct_files dc(dir) as distinct_dirs values(artifact) as artifacts values(Image) as writer_images values(TargetFilename) as sample_paths by _time, host, User
| where distinct_files>=5

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated', 'FileRenamed')
| where FileName endswith '.ralord' or FileName matches regex @'(?i)^README-.*[.]txt$'
| extend ParentDir = strcat_array(array_slice(split(FolderPath, '\\'), 0, -2), '\\')
| summarize DistinctFiles=dcount(FolderPath), DistinctDirs=dcount(ParentDir), Artifacts=make_set(FileName, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessSHA256, bin(Timestamp, 10m)
| where DistinctFiles >= 5

Sigma

title: Nova RALord Ransomware Encrypted File Extension or Ransom Note
id: 6f1c2a4e-3b7d-4e58-9a21-5c8d0e7b1a01
status: experimental
description: Detects creation of files with the .ralord extension or README-suffix.txt ransom notes dropped by the Nova (formerly RALord) Rust ransomware encryptor (TL-2026-5320).
references:
    - https://www.cyjax.com/resources/blog/araastocracy-ralord-ransomware-emerges-with-new-dls
    - https://www.sonicwall.com/blog/nova-raas-the-ransomware-that-spares-schools-and-nonprofits-for-now
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.impact
    - attack.t1486
    - attack.discovery
    - attack.t1083
logsource:
    category: file_event
    product: windows
detection:
    selection_ext:
        TargetFilename|endswith: '.ralord'
    selection_note:
        TargetFilename|contains: '\README-'
        TargetFilename|endswith: '.txt'
    condition: selection_ext or selection_note
falsepositives:
    - Documentation folders that legitimately contain README-suffix.txt files (the note branch is the noisier one)
    - Backup or archive tools that restore a previously encrypted .ralord file
level: high

Known false positives:

  • Software source trees and installers that contain README-*.txt files; the distinct-file threshold suppresses single hits
  • Forensic or restore jobs copying previously encrypted .ralord files

Tuning notes: Tune distinct_files for your environment and exclude known developer and build hosts. If a new Nova build changes the extension, keep the README-suffix.txt branch and add the new extension. Requires Sysmon EventCode 11 collection on endpoints and file servers.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Nova/RALord Ransomware Sample Hash Execution (Xcitium-Reported SHA256/MD5) · unlock with TL Creds
  • Nova/RALord Microsoft Defender Tampering via PowerShell, Service Control and Registry · unlock with TL Creds
  • Nova/RALord Onion Service Contact and Tor/qTox Client Activity · unlock with TL Creds
  • Nova/RALord Affiliate Initial Access via External RDP Logon (Valid Accounts on Exposed RDP) · unlock with TL Creds
  • Nova/RALord Pre-Encryption Termination of Backup, Database and Security Services · unlock with TL Creds
  • Nova/RALord Windows Event Log Clearing via wevtutil or PowerShell · unlock with TL Creds
  • Nova/RALord Pre-Encryption Recovery Inhibition (VSS, Backup Catalog and Boot Recovery Deletion) · unlock with TL Creds
  • Nova/RALord Lateral Movement via SMB Admin Shares (Executable Staging to Multiple Hosts) · unlock with TL Creds

Indicators of compromise for Nova RaaS ransomware

As of 2026-11-05, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5320.

Sample indicators (3 of 22)

  • Domain: novaoddh3vxylxqpsfdjprliknbzgbkv6nkazpzu3cvykrgpyzuywryd[.]onion
  • File hash: 456b9adaabae9f3dce2207aa71410987f0a571cd8c11f2e7b41468501a863606
  • Domain: leak7y2247fj7dbb35rpfyxuyaqtwbshiwxp6h35ttzlhrxmhvi4fead[.]onion

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

22 indicators of compromise · unlock with TL Creds. Compare plans

How Nova RaaS ransomware works

Nova is a ransomware-as-a-service (RaaS) operation that first appeared as RALord in late March 2025, when Cyjax identified its new data leak site (DLS). The first victim was listed on 22 March 2025 and three victims were listed by 28 March. The group announced a rebrand to Nova on 30 April 2025, and the DLS was updated with 'News', 'Nova Chat' and 'Nova Panel' sections. Dexpose reports a separate NOVA RaaS affiliate service introduced on 1 April 2025. A forum persona 'ForLord' was linked to the operation, and Cyjax noted a possible but unconfirmed link to the defunct RAWorld/RAGroup. Leak-site content in English and Russian suggests non-native English speakers. SOCRadar's group profile lists 133 attacks and an alleged affiliate recruitment program. Its two start dates conflict: March 2025 versus first seen October 2025.

The encryptor is written in Rust. SonicWall observed that early samples append the '.ralord' extension and drop a text ransom note with a random character suffix and no fixed ransom amount. The note carries a qTox ID for negotiation, and the process opens a console window via conhost.exe. AttackIQ's analysis, as summarised on detections.ai, describes hybrid encryption with XChaCha20-Poly1305 and RSA-2048 key wrapping. Its attack chain is environment discovery with anti-analysis checks, defence evasion against Microsoft Defender and other EDR/AV using PowerShell, WMI, registry and service control, targeted process and service termination, Volume Shadow Copy deletion, and then encryption. StealthMole reports support for Windows, Linux, NAS, FreeBSD, ESXi and ARM systems.

The business model combines a revenue-share affiliate programme with a standalone encryptor service. Cyjax documented an 85/15 split favouring affiliates, a EUR 200 fee for access to 'Nova Chat', and a direct-purchase encryptor at EUR 200 per attack plus 10% of the ransom and EUR 20 for a data-blog post. StealthMole reports an initial 80/20 split rising to 85/15 after five months and 90/10 after a year, with 95/5 for premium partners. It also reports 'Nova 2.0 (Premium Program) | Katana Version' and an 'APIPN' programme recruiting access to Citrix, Fortinet SSL VPN, SonicWall, RDP and VMware environments. Affiliates are described as functioning as initial access brokers. Xcitium reports initial access through phishing and exposed RDP/VPN, stolen credentials, lateral movement over RDP/SMB, exfiltration and encryption. These are vendor summaries, not hands-on incident-response findings.

Victimology is broad. Cyjax's first victims were in France, Argentina, Brazil and the Dominican Republic. Xcitium counts over 86 targets by early 2026, led by technology, healthcare, manufacturing and education, in the US, France, Brazil, the Netherlands and Spain. StealthMole counts over 122 listings between March 2025 and June 2026, including 6 government entities, and Dexpose cites about 180 claimed victims across 38 countries as of mid-2026. SonicWall noted in April 2025 that the group pledged to stop targeting education and non-profit entities. In May-June 2026 Nova listed Eriell Group, an oilfield services firm headquartered in Uzbekistan, then publicly apologised for violating its CIS-safe-harbour rule, banned the responsible affiliate, and claimed no files were encrypted or data exfiltrated.

Source limitations: SOCRadar's group and victim pages and the Cyble profile returned HTTP 403 and could not be read directly. Their figures come from search-result snippets and the hunt skeleton. No CVEs are cited. No IP address or clearnet domain IOCs were published in the sources, so BeaconBeagle was not queried; the network IOCs are Tor onion services. Hashes and identifiers come from a single vendor source (Xcitium) and should be validated against the sample before use for blocking.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares

Execution

T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Defense Evasion

T1070.004 Indicator Removal: File Deletion; T1497.001 Virtualization/Sandbox Evasion: System Checks

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Remediation for Nova RaaS ransomware

Patches

  • Apply current vendor security updates to Citrix, Fortinet, SonicWall and VMware edge and virtualization products

Immediate actions

  • Block and alert on the published Nova/RALord onion-service identifiers and ransom-note/extension artifacts in file, EDR and proxy telemetry
  • Hunt for Volume Shadow Copy deletion, bulk service/process termination and Microsoft Defender tampering via PowerShell, WMI or registry changes
  • Review exposed RDP, Citrix, Fortinet SSL VPN, SonicWall and VMware access, which the APIPN affiliate programme recruits, and rotate credentials for those services

Workarounds

  • Where patching is delayed, restrict management and VPN interfaces to allow-listed source addresses

Longer-term hardening

  • Enforce MFA and conditional access on all remote-access services and remove unnecessary internet-exposed RDP
  • Maintain offline, immutable, tested backups, including ESXi and NAS targets
  • Deploy EDR with tamper protection for Microsoft Defender and alert on security-tool disablement
  • Restrict lateral movement over RDP/SMB through network segmentation and tiered administration

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: Windows endpoints and servers (encryptor target)
  • Various — Linux, NAS, FreeBSD, VMware ESXi and ARM-based systems
    Vulnerable versions: Per StealthMole, supported by the Nova encryptor

Timeline of Nova RaaS ransomware

  • locked-ioc-19 data leak site emerges (identified late March 2025 by Cyjax); first victim listed on 22 March 2025
  • Three victims listed on the locked-ioc-19 DLS, including organizations in France, Argentina and Brazil
  • Separate locked-ioc-21 RaaS affiliate service introduced, per Dexpose
  • SonicWall reports the Rust-based locked-ioc-19 encryptor (locked-ioc-17 extension) and notes a pledge to stop targeting educational and non-profit entities
  • Rebrand from locked-ioc-19 to locked-ioc-21 announced; DLS lists 16 victims and adds News, locked-ioc-21 Chat and locked-ioc-21 Panel sections
  • Advanced portal with locked-ioc-21 Chat and affiliate registration launched (May 2025 onward, per Xcitium)
  • Novabio Laboratories (France) attacked, with 500GB encrypted; ANG Brothers (Singapore) with 2.5TB stolen in December 2025
  • Dubai Air Wing (UAE) listed, following Epi du Rouergue (6 Jan) and Cisneros Group (11 Jan)
  • Eriell Group, an oilfield services firm in Uzbekistan with Moscow offices, appears on the locked-ioc-21 leak site
  • StealthMole investigation of locked-ioc-21's affiliate network and infrastructure begins, triggered by a France-based rubber and plastics victim; around 122 listings counted from March 2025 to June 2026
  • locked-ioc-21 publicly apologises for violating its CIS-safe-harbour rule, bans the responsible affiliate and says no files were encrypted or exfiltrated

Sources cited for Nova RaaS ransomware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats