Nova
ObscureIQ Threat Intelligence · Actor Profile
NovaConfidence: Medium
Ransomware (RaaS)
Also known as: RALord
Motivation: Financial
2Attributed Breaches Circulating
MediumAttribution Confidence
Ransomware (RaaS)Actor Type
Overview
Formerly RALord, built on leaked Babuk source code, first observed late March 2025 with a bilingual Russian/English leak site and double extortion. Sells services to affiliates and threatens those who 'betray' it.
Tactics, Targeting & TTPs
Sells services to affiliates and threatens those who 'betray' it; early victims include claims against large enterprises.
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.