nova Ransomware Group

Key insights

• •Nova uses a Rust-based ransomware that employs a robust cryptographic scheme including XChaCha20-Poly1305 and RSA-2048.
• •The group escalates ransom demands even after initial payments, which is atypical for ransomware operations.
• •Initial access is often achieved through compromised credentials and exploitation of exposed remote services.
• •Nova targets various sectors, including healthcare, education, and e-commerce.
• •Their communication with victims typically occurs via qTox IDs on a dedicated Tor-based data leak site.