Threat video1:00
Nova RaaS (formerly RALord) Ransomware: Detection & IOCs
Nova runs a Rust double-extortion RaaS that pays affiliates 85%: 9 detection rules, 22 IOCs and 16 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for Nova RaaS (formerly RALord) Ransomware: Detection & IOCs →
Chapters
- 0:00The hookNova ransomware-as-a-service claims about 150 targets.
- 0:05The storyEmerged March as ransomware-as-a-service.
- 0:12Attack pathPhishing or exposed access, they pivot to encrypt and extort.
- 0:25AttributionAttributed to Nova.
- 0:29Indicators of compromise12 indicators to hunt: 8 domains, 1 SHA-256 hash and 1 MD5 hash, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Block and alert on the published Nova/RALord onion-service identifiers.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Nova ransomware-as-a-service claims about 150 targets.
0:05Emerged March as ransomware-as-a-service.
0:08Rebranded April to Nova, recruiting affiliates.
0:12Phishing or exposed access, they pivot to encrypt and extort.
0:16They disable defenses, delete backups, then lock files.
0:20Data theft is copied for double extortion.
0:25Attributed to Nova. Confidence: low.
0:2912 indicators to hunt: 8 domains, 1 SHA-256 hash and 1 MD5 hash, and more.
0:3916 ATT&CK techniques, from initial access to impact.
0:433 steps now: Block and alert on the published Nova/RALord onion-service identifiers.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.