Nova Claims It Targeted Textile Testing Services of America
Summary
Nova claims it targeted Textile Testing Services of America, identifying sandox[.]info as an initial access point and linking data to ttsamexico[.]com. The group says it provided data samples to the company; the claims are unverified.
Key points
- The ransomware.live record names Textile Testing Services of America, a US-based manufacturing company, as the victim and Nova as the actor.
- Nova claims sandox[.]info was the initial access point and identifies IP address 64.76.20.226.
- Nova's OSINT team claims the data is related to ttsamexico[.]com.
- Nova says it provided the company with a data tree and samples after it contacted the group's support department.
- The post is based on public claims by Nova; the article says it cannot confirm their accuracy.
Article Details
- Victim
- Textile Testing Services of America (claimed victim; not independently confirmed)
- Victim Domain
- ttsamexico.com
- Claim Date
- 2026-05-26
- Encryption Status
- Unknown; not reported
- Exfiltration Status
- Claimed by Nova; not independently verified
- Exfiltrated Data
- Nova claimed to have stolen data related to ttsamexico.com and said it provided the company with a data tree and samples.
- Ransom Demand
- Unknown; no demand reported
- Leak Status
- Nova published a claim with related data artifacts, but their authenticity and the extent of any public release are unverified.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sandox[.]info | Reported by Nova's OSINT team as the initial access point; this attribution is part of an unverified ransomware-group claim. |