Skip to main content
Darkfield

Operator dossier

nova is a ransomware operator currently active on public leak sites. Darkfield has indexed 183 public victims claimed by this operator between April 28, 2025 and July 10, 2026. Based on the limited available data, Nova is a recently emerged ransomware operation first observed in April 2025 with an apparent financial motivation, having targeted approximately 95 victims in its brief operational period. The group's origin and potential affiliations remain undocumented by major security firms, though their targeting pattern suggests a broad opportunistic approach rather than geopolitically motivated attacks. Nova's attack methodology and specific technical capabilities have not been publicly detailed by established threat intelligence sources, though their victim distribution across the United States, France, Brazil, Singapore, and the Netherlands indicates either automated widespread targeting or access to diverse initial compromise vectors. The group has demonstrated a preference for targeting healthcare, technology, manufacturing, and education sectors, suggesting they may focus on organizations with critical operational dependencies that increase pressure for ransom payment. Given the group's recent emergence and limited public documentation by major security researchers, Nova's current operational status, organizational structure, and long-term threat trajectory remain largely uncharacterized in established threat intelligence reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by nova

Most recent 150 of 183 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for nova →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

nova

183 victims indexed · first seen 1 year ago · last activity 5 days ago

183
Victims indexed
#48 of 364 tracked operators
1y 3m
Active period
Apr 2025 → Jul 2026
10
Countries hit
top US · 14

At a glance

Status
active
First seen
1 year ago
Last activity
5 days ago
Onion sites
2 known endpoints
Primary sector
Not Found · 37 hits

About

Based on the limited available data, Nova is a recently emerged ransomware operation first observed in April 2025 with an apparent financial motivation, having targeted approximately 95 victims in its brief operational period. The group's origin and potential affiliations remain undocumented by major security firms, though their targeting pattern suggests a broad opportunistic approach rather than geopolitically motivated attacks. Nova's attack methodology and specific technical capabilities have not been publicly detailed by established threat intelligence sources, though their victim distribution across the United States, France, Brazil, Singapore, and the Netherlands indicates either automated widespread targeting or access to diverse initial compromise vectors. The group has demonstrated a preference for targeting healthcare, technology, manufacturing, and education sectors, suggesting they may focus on organizations with critical operational dependencies that increase pressure for ransom payment. Given the group's recent emergence and limited public documentation by major security researchers, Nova's current operational status, organizational structure, and long-term threat trajectory remain largely uncharacterized in established threat intelligence reporting.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

12 months
2025-04-01T00:00:00+00:00 · 162025-05-01T00:00:00+00:00 · 52025-06-01T00:00:00+00:00 · 42025-07-01T00:00:00+00:00 · 102025-08-01T00:00:00+00:00 · 22025-09-01T00:00:00+00:00 · 42025-10-01T00:00:00+00:00 · 162025-11-01T00:00:00+00:00 · 112025-12-01T00:00:00+00:00 · 142026-01-01T00:00:00+00:00 · 82026-02-01T00:00:00+00:00 · 42026-03-01T00:00:00+00:00 · 1
2025-04-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
14
🇫🇷 France
8
🇧🇷 Brazil
6
🇸🇬 Singapore
5
🇳🇱 Netherlands
5
🇪🇸 Spain
5
🇮🇹 Italy
3
🇩🇪 Germany
3
United States dossier →France dossier →Brazil dossier →Singapore dossier →

Top sectors

Healthcare
13
Technology
12
Manufacturing
9
Education
7
Public Sector
3
Hospitality and Tourism
3
Agriculture and Food Production
2
Transportation/Logistics
2
Healthcare dossier →Technology dossier →Manufacturing dossier →Education dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion
  • http://novaxtychr6ohlc4zr5its73p6i7unpuhpwoodtzrg2y4w4seytatlid.onion

Source

Updated 5 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time nova posts a victim.

Add nova to your watchlist — Pro pings you within 5 minutes of any new nova leak-site post, Telegram callout, or affiliate-rebrand inference.