Nova is a Ransomware-as-a-Service (RaaS) group that emerged in April 2025, evolving from its earlier incarnation as RALord, which began operations in March 2025. The group operates on a profit-sharing model with affiliates, offering varying splits, with higher-performing affiliates receiving up to 95% of ransom payments. Nova's primary motivation is financial gain, achieved through a double extortion strategy that involves both encrypting victim systems and exfiltrating sensitive data to pressure payment. Initially, the group notably claimed to abstain from targeting educational institutions and non-profit organizations, even unlisting a school from their leak site; however, subsequent activity shows a departure from this policy with attacks against such entities. A distinguishing characteristic of Nova is its willingness to escalate ransom demands, even after an initial payment has been made, as evidenced in the high-profile Clinical Diagnostics incident. The group actively engages in

Aliases del actor

RALordCVE-2020-10148 (SolarWinds Orion API)SUPERNOVAmediante el dominio wwwcargotaloneaglet implantheadmarephantomc2phantomcorephantomocxphantomproxylitephantomremoteung0901SolarWinds Orion API (CVE-2020-10148)se relaciona con dominiosblogs analizados por fuentes de inteligencia de seguridad"Inc

Actores similares

orionactor · 2evapiksactor · 1capi-backdooractor · 1cve-2023-41991actor · 1cve-2023-36884actor · 1Cloud Instance Metadata APIactor · 1Orion Ransomwareransomware · 0incransomransomware · 832contiransomware · 351inc-ransomactor · 26

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker