Threat Intelligence

Nova Ransomware Gang Recruits Affiliates and Threatens to Leak Stolen Data

SOCRadar · 5 Nov 2026

Key Takeaway Because ransomware groups like Nova both encrypt and steal data, keep tested offline backups and fix exposed weaknesses promptly, since the group says it picks victims by what it can exploit rather than by industry.

Nova is a financially motivated ransomware group that runs a Ransomware-as-a-Service (RaaS) model. It recruits affiliates, supplies them with a Rust-based encryption tool, and uses a dedicated dark web leak site to threaten publication of stolen information. Its victim claims span multiple industries and countries, and the group says it chooses targets based on exploitable weaknesses rather than sector.

The group first appeared as RALord in March 2025 and rebranded as Nova the following month. It carried existing RALord victim listings over to the renamed leak site and added affiliate registration and communication channels. Nova also claims its members took part in other, unnamed ransomware groups in 2018 and 2020. This is unverified, but it suggests the brand may be newer than the people behind it.

Nova's name is easy to confuse with RA World, an older and separate operation active since 2023. In a June 2025 interview, the group claimed it changed its name after rejecting an approach from RA World, which it said wanted to join. That account is unverified and does not support treating Nova as a successor to RA World. Claims linking Nova's encryptor to leaked Babuk source code also remain unconfirmed, and nothing so far establishes shared membership, infrastructure or code between the groups.

ransomware Nova RaaS dark web data extortion

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.