Nova
Nova is a ransomware family and ransomware-as-a-service (RaaS) operation, formerly known as RALord, and described as tied to the RAlord network. Reporting in the provided content states that the ransomware is reportedly based on Babuk source code. Nova encrypts victims’ files and uses double-extortion tactics, attempting to coerce payment for both a decryptor and deletion of stolen data. The group has been associated with leak-site activity on Tor and frequently changing dark web infrastructure; one report also describes distributed onion-based infrastructure and uvicorn-based backend servers.
The content links Nova to attacks and victim claims across multiple sectors, including healthcare, education, professional services, and software. High-confidence examples mentioned include the 2025 attack on Eurofins subsidiary Clinical Diagnostics in the Netherlands, which reportedly resulted in theft of data belonging to almost one million patients, including personal information and medical test results; targeting of Dutch software firm FysioRoadmap, which reportedly exposed information from more than 20,000 patients; a South Korean university listed as a victim; and a claimed breach of KPMG Netherlands, which KPMG publicly denied. The content also states Nova has targeted medical and education sectors and has pursued high-profile corporate victims.
Nova is described as having affiliates and operational rules. One report says Nova mistakenly targeted Eriell Group, a Tashkent-based oilfield services company with operations in Russia, despite the common ransomware norm of avoiding Russian and broader CIS-linked targets. According to that reporting, Eriell contacted Nova, the responsible affiliate was cut off and banned, Nova publicly apologized, and Nova claimed encryption did not occur and data was not published.
The content also references allegations that Nova leaked some Clinical Diagnostics data even after ransom payment, and separately notes an earlier incident involving data from 485,000 Dutch women screened for cervical cancer in which Nova allegedly violated an agreement after payment. Researchers from CBSecurity and Dos-Op.io reportedly investigated Nova and claimed network-configuration mistakes exposed backend addresses and additional attack surfaces. Aliases and related identifiers mentioned in the reporting include RALord, AlexL101m3, ForLord, RALord-RaaS, jhonkarry, BlackBeard, and a recruiter/admin identified as Alex.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth
1 technique
Stealth
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
Impact
1 technique
Impact
A Dutch healthcare software vendor has been knocked offline following a ransomware attack... "On April 7, 2026, Z-CERT received notification that ChipSoft has fallen victim to a ransomware attack," it said. | The country suffered one of its worst breaches in 2025 after a Nova ransomware attack on Eurofins subsidiary Clinical Diagnostics, a cancer-screening laboratory.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation or affiliate referenced as tied to the RAlord network; it accidentally targeted Eriell Group and later apologized, claiming encryption did not occur and data was not published.
Ransomware used in an attack against Eurofins subsidiary Clinical Diagnostics, resulting in stolen patient data and major breach impact.
Ransomware used in an attack against Eurofins subsidiary Clinical Diagnostics, resulting in theft of patient data and major breach impact.
Ad-fraud clicker module delivered via Keenadu (and also embedded in trojanized apps) that uses ML/WebRTC to interact with advertising elements; later iterations appear to act as a loader for additional components including spyware and droppers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.