# Nova (formerly RALord) Ransomware-as-a-Service Group

> Nova, formerly RALord, is a Rust-based ransomware-as-a-service operation active since March 2025 that combines file encryption with data theft (double extortion) for financial gain. Public trackers count roughly 120-180 claimed victims across dozens of countries, and the group recruits affiliates on an 85/15 revenue split.

- **Published:** 2026-11-05T12:21:18Z
- **Last reviewed:** 2026-11-05T12:21:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5320
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5320.png
- **ID:** TL-2026-5320
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Nova
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

Nova is a ransomware-as-a-service (RaaS) operation that first appeared as RALord in late March 2025, when Cyjax identified its new data leak site (DLS). The first victim was listed on 22 March 2025 and three victims were listed by 28 March. The group announced a rebrand to Nova on 30 April 2025, and the DLS was updated with 'News', 'Nova Chat' and 'Nova Panel' sections. Dexpose reports a separate NOVA RaaS affiliate service introduced on 1 April 2025. A forum persona 'ForLord' was linked to the operation, and Cyjax noted a possible but unconfirmed link to the defunct RAWorld/RAGroup. Leak-site content in English and Russian suggests non-native English speakers. SOCRadar's group profile lists 133 attacks and an alleged affiliate recruitment program. Its two start dates conflict: March 2025 versus first seen October 2025.

The encryptor is written in Rust. SonicWall observed that early samples append the '.ralord' extension and drop a text ransom note with a random character suffix and no fixed ransom amount. The note carries a qTox ID for negotiation, and the process opens a console window via conhost.exe. AttackIQ's analysis, as summarised on detections.ai, describes hybrid encryption with XChaCha20-Poly1305 and RSA-2048 key wrapping. Its attack chain is environment discovery with anti-analysis checks, defence evasion against Microsoft Defender and other EDR/AV using PowerShell, WMI, registry and service control, targeted process and service termination, Volume Shadow Copy deletion, and then encryption. StealthMole reports support for Windows, Linux, NAS, FreeBSD, ESXi and ARM systems.

The business model combines a revenue-share affiliate programme with a standalone encryptor service. Cyjax documented an 85/15 split favouring affiliates, a EUR 200 fee for access to 'Nova Chat', and a direct-purchase encryptor at EUR 200 per attack plus 10% of the ransom and EUR 20 for a data-blog post. StealthMole reports an initial 80/20 split rising to 85/15 after five months and 90/10 after a year, with 95/5 for premium partners. It also reports 'Nova 2.0 (Premium Program) | Katana Version' and an 'APIPN' programme recruiting access to Citrix, Fortinet SSL VPN, SonicWall, RDP and VMware environments. Affiliates are described as functioning as initial access brokers. Xcitium reports initial access through phishing and exposed RDP/VPN, stolen credentials, lateral movement over RDP/SMB, exfiltration and encryption. These are vendor summaries, not hands-on incident-response findings.

Victimology is broad. Cyjax's first victims were in France, Argentina, Brazil and the Dominican Republic. Xcitium counts over 86 targets by early 2026, led by technology, healthcare, manufacturing and education, in the US, France, Brazil, the Netherlands and Spain. StealthMole counts over 122 listings between March 2025 and June 2026, including 6 government entities, and Dexpose cites about 180 claimed victims across 38 countries as of mid-2026. SonicWall noted in April 2025 that the group pledged to stop targeting education and non-profit entities. In May-June 2026 Nova listed Eriell Group, an oilfield services firm headquartered in Uzbekistan, then publicly apologised for violating its CIS-safe-harbour rule, banned the responsible affiliate, and claimed no files were encrypted or data exfiltrated.

Source limitations: SOCRadar's group and victim pages and the Cyble profile returned HTTP 403 and could not be read directly. Their figures come from search-result snippets and the hunt skeleton. No CVEs are cited. No IP address or clearnet domain IOCs were published in the sources, so BeaconBeagle was not queried; the network IOCs are Tor onion services. Hashes and identifiers come from a single vendor source (Xcitium) and should be validated against the sample before use for blocking.

## MITRE ATT&CK

- T1566 Phishing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1070.004 Indicator Removal: File Deletion
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1112 Modify Registry
- T1057 Process Discovery
- T1082 System Information Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Nova/RALord Ransomware Encryption Artifacts (.ralord Extension and README Ransom Notes)** (`TL-2026-5320-SPL-001`)

Detects the file-system footprint of the Rust-based Nova (formerly RALord) encryptor tracked as TL-2026-5320: files carrying the .ralord extension and README-<random suffix>.txt ransom notes (containing a qTox contact ID) written in bulk by one process on one host. Five or more distinct artifact paths inside 10 minutes indicates active encryption rather than a single stray file, and distinct_dirs shows how many directories the encryptor walked (file and directory discovery, T1083), so a high value means broad traversal of the file system or shares. Later Nova builds may change the extension, so the ransom-note branch provides the fallback.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1486, T1083
- **Data sources:** sysmon
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
```Nova/RALord TL-2026-5320 encryptor artifacts: .ralord extension and README-suffix.txt ransom notes```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h
| eval tfn=lower(TargetFilename)
| eval artifact=case(like(tfn,"%.ralord"),"ralord_extension", like(tfn,"%readme-%.txt"),"ransom_note")
| where isnotnull(artifact)
| eval dir=mvjoin(mvindex(split(TargetFilename,"\\"),0,-2),"\\")
| bin _time span=10m
| stats dc(TargetFilename) as distinct_files dc(dir) as distinct_dirs values(artifact) as artifacts values(Image) as writer_images values(TargetFilename) as sample_paths by _time, host, User
| where distinct_files>=5
````

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated', 'FileRenamed')
| where FileName endswith '.ralord' or FileName matches regex @'(?i)^README-.*[.]txt$'
| extend ParentDir = strcat_array(array_slice(split(FolderPath, '\\'), 0, -2), '\\')
| summarize DistinctFiles=dcount(FolderPath), DistinctDirs=dcount(ParentDir), Artifacts=make_set(FileName, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessSHA256, bin(Timestamp, 10m)
| where DistinctFiles >= 5
```

### Sigma

```yaml
title: Nova RALord Ransomware Encrypted File Extension or Ransom Note
id: 6f1c2a4e-3b7d-4e58-9a21-5c8d0e7b1a01
status: experimental
description: Detects creation of files with the .ralord extension or README-suffix.txt ransom notes dropped by the Nova (formerly RALord) Rust ransomware encryptor (TL-2026-5320).
references:
    - https://www.cyjax.com/resources/blog/araastocracy-ralord-ransomware-emerges-with-new-dls
    - https://www.sonicwall.com/blog/nova-raas-the-ransomware-that-spares-schools-and-nonprofits-for-now
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.impact
    - attack.t1486
    - attack.discovery
    - attack.t1083
logsource:
    category: file_event
    product: windows
detection:
    selection_ext:
        TargetFilename|endswith: '.ralord'
    selection_note:
        TargetFilename|contains: '\README-'
        TargetFilename|endswith: '.txt'
    condition: selection_ext or selection_note
falsepositives:
    - Documentation folders that legitimately contain README-suffix.txt files (the note branch is the noisier one)
    - Backup or archive tools that restore a previously encrypted .ralord file
level: high

```

**Known false positives:**

- Software source trees and installers that contain README-*.txt files; the distinct-file threshold suppresses single hits
- Forensic or restore jobs copying previously encrypted .ralord files

**Tuning notes:** Tune distinct_files for your environment and exclude known developer and build hosts. If a new Nova build changes the extension, keep the README-suffix.txt branch and add the new extension. Requires Sysmon EventCode 11 collection on endpoints and file servers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Nova/RALord Ransomware Sample Hash Execution (Xcitium-Reported SHA256/MD5) (locked: unlock with TL Creds)
- Nova/RALord Microsoft Defender Tampering via PowerShell, Service Control and Registry (locked: unlock with TL Creds)
- Nova/RALord Onion Service Contact and Tor/qTox Client Activity (locked: unlock with TL Creds)
- Nova/RALord Affiliate Initial Access via External RDP Logon (Valid Accounts on Exposed RDP) (locked: unlock with TL Creds)
- Nova/RALord Pre-Encryption Termination of Backup, Database and Security Services (locked: unlock with TL Creds)
- Nova/RALord Windows Event Log Clearing via wevtutil or PowerShell (locked: unlock with TL Creds)
- Nova/RALord Pre-Encryption Recovery Inhibition (VSS, Backup Catalog and Boot Recovery Deletion) (locked: unlock with TL Creds)
- Nova/RALord Lateral Movement via SMB Admin Shares (Executable Staging to Multiple Hosts) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- Domain: `novaoddh3vxylxqpsfdjprliknbzgbkv6nkazpzu3cvykrgpyzuywryd[.]onion`
- File hash: `456b9adaabae9f3dce2207aa71410987f0a571cd8c11f2e7b41468501a863606`
- Domain: `leak7y2247fj7dbb35rpfyxuyaqtwbshiwxp6h35ttzlhrxmhvi4fead[.]onion`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [nova Ransomware Group Profile (SOCRadar)](https://socradar.io/free-tools/ransomware-intelligence/groups/nova)
- [SOCRadar Nova ransomware victim breach report (Alexandria)](https://socradar.io/data-breach/alexandria-nova-ransomware-2026/)
- [ARaaStocracy - RALord ransomware emerges with new DLS (Cyjax)](https://www.cyjax.com/resources/blog/araastocracy-ralord-ransomware-emerges-with-new-dls)
- [Nova RaaS: The ransomware that spares schools and nonprofits, for now (SonicWall)](https://www.sonicwall.com/blog/nova-raas-the-ransomware-that-spares-schools-and-nonprofits-for-now)
- [Beyond the Leak Blog: Investigating Nova's Affiliate Network, Infrastructure, and Operations (StealthMole)](https://stealthmole-intelligence-hub.blogspot.com/2026/06/beyond-leak-blog-investigating-novas.html)
- [Analyzing Nova Ransomware Rust-Based Evasion and Encryption (detections.ai, citing AttackIQ)](https://detections.ai/intel-exchange/019fd68c-5d76-7599-9308-780cdd4d55ee)
- [From RALord to Nova: How This RaaS Gang Is Wreaking Havoc Worldwide (Xcitium)](https://threatlabsnews.xcitium.com/?p=31051)
- [Unmasking a Nova Ransomware Operator: Following Reused Contact Methods (Dexpose)](https://www.dexpose.io/unmasking-a-nova-ransomware-operator-following-reused-contact-methods-to-a-real-world-identity/)
- [Nova Ransomware Apologizes for CIS Rule Violation, Bans Affiliate (Daily Security Review)](https://dailysecurityreview.com/?p=40344)
- [Breaking: DoS op exposes the Nova RaaS gang (DataBreaches.net)](https://databreaches.net/2025/11/30/breaking-dos-op-exposes-the-nova-raas-gang/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5320