RALord is a criminal ransomware group known for using Rust-based payloads on the NOVA RaaS platform.
RALord is a criminal ransomware group launched in March 2025 on the NOVA RaaS platform. It targets healthcare, education, hospitality, and IT sectors across multiple continents. The group uses a Rust-based payload and operates with an 85/15 affiliate revenue split; it has since rebranded as "Nova." Defenders should focus on detecting Rust-based ransomware payloads and monitor TTPs associated with the NOVA RaaS ecosystem.
RALord is a ransomware group identified in March 2025 operating within the NOVA RaaS platform, targeting healthcare, education, hospitality, and IT sectors across multiple continents, using a Rust-based payload with an 85/15 affiliate revenue split; it later rebranded as "Nova."
RALord primarily targets the healthcare, education, hospitality, and IT sectors.
RALord offers its affiliates an 85/15 revenue split.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.