Dark Web Profile: Nova Ransomware

Nova (formerly RALord) is a financially motivated Ransomware-as-a-Service (RaaS) operation that supplies a Rust-based encryptor to affiliates and uses double-extortion via a dark web leak site; SOCRadar tracked 177 claimed victims across 45 countries and multiple industries. The report describes sample-level behaviors (debugger evasion, Defender tampering, VSS deletion, XChaCha20-Poly1305 encryption with RSA-2048 key protection), affiliate responsibilities for initial access and exfiltration, mappings to MITRE ATT&CK, and concrete mitigations including MFA, immutable backups, expanded EDR coverage, and monitoring for defense-evasion indicators.