Nova is a Ransomware-as-a-Service (RaaS) group that emerged in April 2025, evolving from its earlier incarnation as RALord, which began operations in March 2025. The group operates on a profit-sharing model with affiliates, offering varying splits, with higher-performing affiliates receiving up to 95% of ransom payments. Nova's primary motivation is financial gain, achieved through a double extortion strategy that involves both encrypting victim systems and exfiltrating sensitive data to pressure payment. Initially, the group notably claimed to abstain from targeting educational institutions and non-profit organizations, even unlisting a school from their leak site; however, subsequent activity shows a departure from this policy with attacks against such entities. A distinguishing characteristic of Nova is its willingness to escalate ransom demands, even after an initial payment has been made, as evidenced in the high-profile Clinical Diagnostics incident. The group actively engages in

Aliases del actor

RALordSolarWinds Orion API (CVE-2020-10148)SUPERNOVAse relaciona con dominiosblogs analizados por fuentes de inteligencia de seguridad"IncCVE-2020-10148 (SolarWinds Orion API)mediante el dominio wwwcargotaloneaglet implantheadmarephantomc2phantomcorephantomocxphantomproxylitephantomremoteung0901

Actores similares

orionthreat-actor · 2evapiksactor · 1capi-backdooractor · 1Cloud Instance Metadata APIactor · 1Orion Ransomwareransomware · 0Orion Leaksthreat-actor · 0incransomransomware · 832contiransomware · 351inc-ransomactor · 26braincipheractor · 22

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker