Nova Ransomware Profile Details Rust Encryptor, Evasion Tactics and Defenses
Summary
SOCRadar profiles Nova (formerly RALord), combining leak-site trend data with analysis of Rust encryptor samples that interfere with defenses, clear logs, delete shadow copies and encrypt files. It also outlines defensive measures.
Key points
- The group first appeared as RALord in March 2025 and adopted the Nova name the following month. Claims linking it to RA World or leaked Babuk source code remain unconfirmed.
- SOCRadar tracked 177 organizations listed on Nova's leak site across 45 countries and 10 sectors from April 2025 to July 2026; listings are claims, and posting dates may not match attack dates.
- Analyzed Windows builds check for debugging and monitoring tools and may interfere with Defender and other security products through PowerShell, registry changes and service manipulation.
- A later analyzed build clears Windows Event Logs and deletes Volume Shadow Copies using vssadmin and wmic, inhibiting recovery.
- The later Rust build uses XChaCha20-Poly1305 to encrypt files and RSA-2048 to protect encryption keys; behaviors and artifacts differ between samples.
- The article says no consistent Nova-specific initial-access vector has been identified; affiliate advertisements describe affiliates supplying validated network access and extracting data.
- Recommended defenses include MFA for VPN and RDP, offline or immutable backups, monitoring for security-control tampering and shadow-copy deletion, and coverage for Linux and hypervisor environments.
Article Details
- Attack Vectors
- Nova affiliates are instructed to provide validated access to compromised networks, but the article says no consistent Nova-specific entry vector has been identified.
- Affiliates are instructed to extract sensitive information before deploying ransomware; Nova advertises both encryption-only attacks and double extortion.
- An analyzed Windows build checks for debuggers, enumerates running processes, and terminates itself when it detects specified reverse-engineering, debugging, or monitoring tools.
- A later analyzed build uses PowerShell, registry changes, and service manipulation to interfere with endpoint protection, including disabling Microsoft Defender protections, adding scan exclusions, stopping security services, and terminating security-related processes.
- The analyzed Windows build clears Windows Event Logs, deletes Volume Shadow Copies using vssadmin and wmic, and encrypts files.
- Third-party reporting describes bcdedit commands used in some Nova intrusions to force Safe Mode with Networking before encryption, and remote access tools used for lateral movement and persistence.
- Defensive Notes
- Enforce MFA on VPN and RDP access, disable internet-facing RDP where it is not required, and rotate credentials that may have appeared in credential-stuffing campaigns or initial-access-broker listings.
- Maintain offline or immutable backups inaccessible from the production network, and regularly test recovery procedures; shadow copies alone may not provide recovery.
- Extend endpoint detection and response coverage to Linux hosts and hypervisor management interfaces, in light of advertised Linux and boot-locker variants and third-party reporting of VMware ESXi payloads.
- Alert on unauthorized Microsoft Defender policy or scan-exclusion changes, bulk Volume Shadow Copy deletion, mass clearing of Windows Event Logs, anomalous PowerShell activity, and unauthorized bcdedit boot-configuration changes.
- Enable tamper protection and alert on attempts to stop or disable endpoint-security services.
- Allowlist approved remote-access software and alert on unauthorized installation or execution.
- Monitor dark-web marketplaces and leak sites for exposed corporate credentials, VPN access listings, and victim disclosures.
MITRE ATT&CK
T1057 · Process DiscoveryA later analyzed Windows build enumerates running processes.T1059.001 · PowerShellThe later analyzed build uses PowerShell to interfere with endpoint protection.T1070.001 · Clear Windows Event LogsThe analyzed build clears Windows Event Logs across multiple channels.T1219.002 · Remote Desktop SoftwareThird-party reporting says Nova affiliates used remote-access tools including AnyDesk and LogMeIn for lateral movement and persistence.T1486 · Data Encrypted for ImpactThe analyzed Rust build encrypts victim files using XChaCha20-Poly1305 and protects encryption keys with RSA-2048.T1490 · Inhibit System RecoveryThe analyzed Windows build deletes Volume Shadow Copies using vssadmin and wmic.T1562.001 · Disable or Modify ToolsThe analyzed build attempts to disable Microsoft Defender protections, add scan exclusions, stop security services, and terminate security-related processes.T1562.009 · Safe Mode BootThird-party reporting describes bcdedit commands forcing Safe Mode with Networking before encryption in some Nova intrusions.T1622 · Debugger EvasionA later analyzed Windows build checks for a debugger and terminates itself when it detects specified debugging or reverse-engineering tools.
Threat Actors
NovaThe article describes Nova as a financially motivated ransomware group operating a RaaS model, using encryption and data-theft threats to extort organizations.RA GroupThe article says RA World first emerged as RA Group and treats the names as referring to the same operation.RA WorldThe article identifies RA World as a separate ransomware operation. Nova's actors claimed that RA World approached them about joining, but that account is unverified and does not establish shared membership or succession.RALordThe group first appeared under the RALord name in March 2025 and rebranded as Nova in April 2025; the article treats the names as referring to the same group.
Products
Microsoft Defender Antimalware PlatformDisable Microsoft Defender protections and add drive-wide scan exclusions.Microsoft WindowsNova’s analyzed Windows encryptor contains Rust standard-library paths and Cargo dependency references, which identify it as a Rust-based executable.VMware ESXiNova advertises a Linux variant and a boot locker, and third-party reporting describes VMware ESXi payloads.
Tools
AnyDeskMaintain an allowlist of approved remote access software and alert on unauthorized installation or execution of tools such as PuTTY, AnyDesk, or LogMeIn.LogMeInMaintain an allowlist of approved remote access software and alert on unauthorized installation or execution of tools such as PuTTY, AnyDesk, or LogMeIn.PuTTYMaintain an allowlist of approved remote access software and alert on unauthorized installation or execution of tools such as PuTTY, AnyDesk, or LogMeIn.
Industries
DefenseGovernment and defense organizations represent another 5.6%, showing that Nova also targets the public sector.GovernmentGovernment and defense organizations represent another 5.6%, showing that Nova also targets the public sector.ManufacturingTechnology and manufacturing together account for approximately 45% of Nova’s claimed victims.TechnologyTechnology and manufacturing together account for approximately 45% of Nova’s claimed victims.