Nova is a Ransomware-as-a-Service (RaaS) group that emerged in April 2025, evolving from its earlier incarnation as RALord, which began operations in March 2025. The group operates on a profit-sharing model with affiliates, offering varying splits, with higher-performing affiliates receiving up to 95% of ransom payments. Nova's primary motivation is financial gain, achieved through a double extortion strategy that involves both encrypting victim systems and exfiltrating sensitive data to pressure payment. Initially, the group notably claimed to abstain from targeting educational institutions and non-profit organizations, even unlisting a school from their leak site; however, subsequent activity shows a departure from this policy with attacks against such entities. A distinguishing characteristic of Nova is its willingness to escalate ransom demands, even after an initial payment has been made, as evidenced in the high-profile Clinical Diagnostics incident. The group actively engages in

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker