Skip to main content
Mallory
MalwareRansomware

Nova

Nova is a ransomware family and ransomware-as-a-service (RaaS) operation, formerly known as RALord, and described as tied to the RAlord network. Reporting in the provided content states that the ransomware is reportedly based on Babuk source code. Nova encrypts victims’ files and uses double-extortion tactics, attempting to coerce payment for both a decryptor and deletion of stolen data. The group has been associated with leak-site activity on Tor and frequently changing dark web infrastructure; one report also describes distributed onion-based infrastructure and uvicorn-based backend servers.

The content links Nova to attacks and victim claims across multiple sectors, including healthcare, education, professional services, and software. High-confidence examples mentioned include the 2025 attack on Eurofins subsidiary Clinical Diagnostics in the Netherlands, which reportedly resulted in theft of data belonging to almost one million patients, including personal information and medical test results; targeting of Dutch software firm FysioRoadmap, which reportedly exposed information from more than 20,000 patients; a South Korean university listed as a victim; and a claimed breach of KPMG Netherlands, which KPMG publicly denied. The content also states Nova has targeted medical and education sectors and has pursued high-profile corporate victims.

Nova is described as having affiliates and operational rules. One report says Nova mistakenly targeted Eriell Group, a Tashkent-based oilfield services company with operations in Russia, despite the common ransomware norm of avoiding Russian and broader CIS-linked targets. According to that reporting, Eriell contacted Nova, the responsible affiliate was cut off and banned, Nova publicly apologized, and Nova claimed encryption did not occur and data was not published.

The content also references allegations that Nova leaked some Clinical Diagnostics data even after ransom payment, and separately notes an earlier incident involving data from 485,000 Dutch women screened for cervical cancer in which Nova allegedly violated an agreement after payment. Researchers from CBSecurity and Dos-Op.io reportedly investigated Nova and claimed network-configuration mistakes exposed backend addresses and additional attack surfaces. Aliases and related identifiers mentioned in the reporting include RALord, AlexL101m3, ForLord, RALord-RaaS, jhonkarry, BlackBeard, and a recruiter/admin identified as Alex.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique
T1036MasqueradingEvidence2

“Keenadu was also distributed via modified popular apps from unofficial stores and even Google Play, where trojanized smart camera apps with over 300,000 downloads…”

Command and Control

1 technique
T1105Ingress Tool TransferEvidence1

“Keenadu’s backdoor… loads extra malicious modules from its C2 server… The modules are downloaded from Amazon AWS, verified with MD5 and DSA signatures, then decrypted and executed.”

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

Almost one million patients had their data stolen, including basic personal information, highly sensitive Pap smear results, and skin and urine test results.

Impact

1 technique
T1486Data Encrypted for ImpactEvidence1

A Dutch healthcare software vendor has been knocked offline following a ransomware attack... "On April 7, 2026, Z-CERT received notification that ChipSoft has fallen victim to a ransomware attack," it said. | The country suffered one of its worst breaches in 2025 after a Nova ransomware attack on Eurofins subsidiary Clinical Diagnostics, a cancer-screening laboratory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.