Nova (formerly RALord) is a ransomware-as-a-service (RaaS) group that encrypts victims’files and uses double-extortion tactics to pressure organizations into paying for decryption and data non-disclosure.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
nova ransomware
*/
rule nova_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.nova"
description = "Detects nova ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "nova" ascii nocase
$name2 = "NOVA" ascii
$onion = "nova.onion" ascii nocase
condition:
any of them
}
----------------------------------------------------------------------------- Ransom ----------------------------------------------------------------------------- -> Hello , without any problems , if you see this Readme its mean you under controll by Nova ransomware , Data stolen and will be leaked if didn't contact us in 48 hours - encrypted files have ext .[victim_name]NV DON'T TOUCH IT -> Data from your network will be leaked in 10 days , take action and get in touch please --- make sure that the best way to less the time for you is contacted us to recover and decrypt your secret data and stop leak operation ----------------- >>> what we will provide and help with ? -> we will provide advanced decryptor easy for use and we will return every file or data we delete or stole from your Network -> we will give you link to download data stolen from your network as plus recover -> we provide report to how fix your network , and how we gain access and bypass your security, and some advice to up your security ----------------- >>> contact us here (use tor Browser to access chat): download tor from torproject.org ---------------- Chat system (TOR) join link : [redactado] put any username to join ---------------- - our [redactado] messanger ID (Add ons , please use chat in tor to contact , contact in [redactado] if you can't access chat) : [redactado] ([redactado] - also you can use [redactado] ID : [redactado] ----------------- >>> important notes : -> please do not touch the files becouse we can't decrypt it if you touch it -> please contact us today or soon a possible , becouse the leak operation should start , and we will not decrypt or recover you after time ----------------- - your leak post will be in our Blog : [redactado] ----------------------------------------------------------------------------- Ransom -----------------------------------------------------------------------------
The trevi.it website is the official brand portal for the Italian consumer electronics company Trevi S.p.A., which is owned by Trevidea srl - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
Universitas Nasional (UNAS) is an educational institution that offers a wide range of academic programs, including undergraduate and postgraduate degrees across various faculties such as Social Sciences, Law, Economics, and Health Sciences. The university aims to provide quality education and has implemented a robust internal quality assurance system. UNAS serves students from diverse backgrounds, including those pursuing regular and recognition of prior learning (RPL) pathways. Additionally, the university engages in research, community service, and hosts international conferences to enhance academic collaboration - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| Trevi | IT | Construction | — | 9 jun 2026 |
| Universitas Nasional | ID | Education | — | 6 jun 2026 |
| Aspire hospital | IN | Healthcare | — | 5 jun 2026 |
| Everlite concept | FR | Not Found | — | 2 jun 2026 |
| IBENA Textilwerke | DE | Manufacturing | — | 2 jun 2026 |
| LTI Services and Larick Towing | US | Transportation/Logistics | — | 30 may 2026 |
| BC3 Tecnologia | BR | Technology | — | 30 may 2026 |
| Daegu University AI Department | KR | Education | — | 29 may 2026 |
| Badan Pangan Nasional | ID | Agriculture and Food Production | — | 29 may 2026 |
| SECONT Secretaria de Controle e Transparência | BR | Public Sector | — | 24 may 2026 |
| Desysweb | PE | Technology | — | 8 may 2026 |
| International Business Solution de México | MX | Business Services | — | 6 abr 2026 |
| VX Case | BR | Consumer Services | — | 29 mar 2026 |
| Cisneros group | VE | Consumer Services | — | 11 ene 2026 |
| Sense Eletronica | BR | Technology | — | 23 dic 2025 |
| Atenção Primária à Saúde Brazil | BR | Healthcare | — | 4 dic 2025 |
| Saude Fortaleza | BR | Healthcare | — | 15 nov 2025 |
| Medidores Industriales y Medicos SA de CV | MX | Manufacturing | — | 15 nov 2025 |
| BRDSoft | BR | Telecommunication | — | 21 oct 2025 |
| Ministerio de Salud de la Nación argentina | AR | Public Sector | — | 12 oct 2025 |
| SD Soluciones Digitales | MX | Technology | — | 5 oct 2025 |
| LCM Construção e Comércio S/A | BR | Construction | — | 11 jul 2025 |
| Rama judicial colombia | CO | Public Sector | — | 3 jul 2025 |
| SJERP | DO | Technology | — | 29 abr 2025 |
| Tomio Ingeniería | AR | Construction | — | 28 abr 2025 |
| Ihara | BR | Manufacturing | — | 28 abr 2025 |
| bettininformatica - suporteon | BR | Technology | — | 28 abr 2025 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
Both aspirehospitals.co.in and aspirehospitals.in Under Nova Company Control, servers encrypted and patients data stolen, A Healthcare provider based on Plot No: 163, 208, Ekamra Road, Unit-6, Ganga Nagar, Bhubaneswar, India, Odisha, you need to think well to contact us for recover and to secure patients records - Nova Provide tree and samples from stolen data, free 2 files decrypt to the company when its get in touch with support department.
Everlite Concept is a French company that specializes in polycarbonate solutions for building envelopes. It is known for its innovative, high-performance systems used in walls, roofing, and façades for buildings like sports complexes and museums - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
IBENA HEIMTEX is a family-owned textile manufacturer based in Bocholt, Germany, established in 1826. The company specializes in high-quality home textiles, including cuddly blankets, bed linen, and technical textiles for various industries. Their products cater to both consumers and businesses, with offerings such as fireproof fabrics, digital printing textiles, and car interior fabrics for renowned automotive brands. IBENA is committed to sustainability and quality, ensuring their textiles meet numerous quality standards - Nova Provide tree and samples from stolen data, free 2 files decrypt to the company when its get in touch with support department.
ltiservices.com - laricktowing.com - LTI Services is a leading customization and accessory shop specializing in customizations, repairs, and aftermarket parts for the heavy-duty trucking industry. They work with major truck brands such as Peterbilt, Kenworth, Volvo, International, Freightliner, and Western Star, offering a wide range of services including collision repair, custom fabrication, and electrical repairs. The company prides itself on providing quality parts and accessories while collaborating closely with customers to bring their design visions to life. With a focus on transparency and comprehensive service, LTI Services ensures that clients are informed and confident throughout the project process - Larick Towing Inc. is a family-owned and operated business that has been providing vehicle transportation services since 1978. They offer nationwide vehicle transportation, including pick-up and delivery services for transporters, as well as transport to all ship ports and terminals. Their services cater to both individual clients and auto dealers, facilitating vehicle transport to and from auctions and dealer swaps. The company is known for its customer-focused approach and commitment to quality service - Nova provide free decrypt 2 files as proof, we will leak only DBs, not source code because company may recover from leak) 11 days available to reach us or no recover possible, both sites seized.