Loading threat actor…
Nova is a ransomware and extortion threat actor active by at least 2026 and tracked under aliases including nova_group and nova_raas. The group has been observed publicly claiming victims across multiple countries and sectors, indicating broad opportunistic targeting rather than a narrowly specialized victim profile. Reported victims include organizations in information technology and managed services, financial services, healthcare, education, telecommunications, logistics, consumer-facing businesses, and government-related entities. Nova’s operations are consistent with data-theft-enabled ransomware and extortion. The group has been associated with victim claims involving encrypted systems, theft of sensitive data, and offers to provide file trees, samples of stolen material, and limited decryption proof during negotiations. This supports use of encryption combined with exfiltration-based pressure, and in some cases extortion centered on stolen data exposure. Nova has also operated a leak-site style public victim-posting model, as reflected by repeated public claims and victim listings. Observed targeting includes organizations in the United States, Indonesia, Argentina, France, Singapore, Brazil, Turkey, Italy, India, and Malaysia, among others. Specific victim reporting also places Nova activity against higher-education institutions and public-sector entities, including state or government-linked organizations. Sector evidence supports targeting of technology providers, financial institutions, hospitals, universities, telecommunications-related organizations, logistics firms, consumer retail businesses, and government bodies. Available information supports classifying Nova primarily as a financially motivated cybercriminal actor. No high-confidence evidence in the supplied facts attributes Nova to a nation state or identifies a reliable country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
14 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware group mentioned among the active groups targeting educational institutions in the reporting period.
Conducting a ransomware attack and associated data theft/extortion against SistNet, including providing a tree and samples from stolen data and offering a decrypt sample upon contact with their support department.
Conducting a ransomware attack and data theft/extortion against Center Of Information Technologies In Finance Public Institution, including providing a tree and samples of stolen data to pressure the victim to contact support.
A ransomware group named as one of the perpetrators claiming attacks against the education sector in the first half of 2026.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.