// THREAT ACTOR
NOVA_
ActiveNOVA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of NOVA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
183
Victims tracked
1 / 23
Active mirrors
2025-04-28
First listing
2026-07-25
Most recent
Victims by year
- 2026 95
- 2025 88
Leak site mirrors
23 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
novavdivko2zvtrvtllnq45lxhba2rfzp76qigb4nrliklem5au7czqd.onionUpdate Links - Nova GBlog snapshot · 2026-08-19 17:28 -
novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onionNova Panel | Login snapshot · 2025-07-11 21:06 -
novaeogps7purkdhxmaymmnanqiwtqf3r3iu3we4khkzwegkoefbxnyd.onionNova Official - Nova Chat snapshot · 2025-07-11 22:12 -
novav75eqkjoxct7xuhhwnjw5uaaxvznhtbykq6zal5x7tfevxzjyqyd.onionUpdate Links - Nova GBlog snapshot · 2026-08-19 14:18 -
novavagygnhqyf7a5tgbuvmujve5a2jzgbrq2n4dvetkhvr2zjg27cad.onionUpdate Links - Nova GBlog snapshot · 2026-08-19 21:00 -
novatd4577pzlvdyy42slydhrhru7fpcflbbxlajcmbfrgzyeis6d3id.onionsnapshot · 2025-11-21 02:15 -
novag4k2te3mstt2xq5irywlpaw6edgkpiwgg4t2q7eecisj2qqtvbid.onionsnapshot · 2025-11-21 02:04 -
novaoddh3vxylxqpsfdjprliknbzgbkv6nkazpzu3cvykrgpyzuywryd.onionsnapshot · 2025-11-21 01:01 -
vctmy3tytuah2offux4bixzunh53pnepsnsrr2hly6blpgiewqodnzad.onionsnapshot · 2025-11-21 03:10 -
leak7y2247fj7dbb35rpfyxuyaqtwbshiwxp6h35ttzlhrxmhvi4fead.onionsnapshot · 2025-11-21 00:07 -
novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onionsnapshot · 2025-06-06 20:05 -
nova5cr2op6uo73korzmzkvil2btj3erjaujwtbbvtpko3yx7ivq3myd.onionsnapshot · 2025-06-06 20:05 -
nova25eabfdep76t52dt34n2qdrhrn7vxuaeitcy5x2ovxnut767bwid.onionsnapshot · 2025-06-06 20:06 -
npnlc7i2mxnngj6angcj5pwesbaapksstqqez2qmtgmimezcpo4haryd.onionsnapshot · 2025-06-06 20:06 -
raaskpzmkcoraswmzotjkzplq3aw6mcbogvd5uzbgsnhqb7az3ax2qid.onionsnapshot · 2025-06-06 20:06 -
novaeogps7purkdhxmaymmnanqiwtqf3r3iu3we4khkzwegkoefbxnyd.onionNova Official - Nova Chat snapshot · 2025-07-11 20:07 -
noval3kb6snxuofmqmw2we3cvzci2tfknurgxi7gdyet55xh6zhno5id.onionNova Official - Nova Chat snapshot · 2025-07-11 22:06 -
ms5fasbpbfpbxmgtrhcspvg5ajmb2tpxdcg7x2wdd6equemuivqi5syd.onionNC V2 | Nova Clouds snapshot · 2025-08-14 11:10 -
pifk3xu3vad6cuxsjll4qjomyaaaoyvnyqppro75pazadzctrrvpdnyd.onion403 Forbidden snapshot · 2026-08-14 10:00 -
novaxtychr6ohlc4zr5its73p6i7unpuhpwoodtzrg2y4w4seytatlid.onionNova Blog snapshot · 2025-10-01 09:12 -
novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onionNova Blog snapshot · 2026-07-30 16:39 -
novamojnnc7n7brrnflr7evyrho2e5ynskicrjxuvhn5r6jjlxyjj4ad.onionNova - Ransomware-as-a-Service Platform snapshot · 2025-11-08 07:01 -
cceoxb5youzqo2uk7t7274ittlphj6vimzkjtu75yi5grceqozm5znid.onionNova - Ransomware-as-a-Service Platform snapshot · 2025-11-08 22:15
Recent victims
The 50 most recent victims claimed by NOVA. Total in the index: 183.
| Date listed | Victim | Description |
|---|---|---|
| 2026-07-25 | SistNet | Sistnet, a division of Sistemi Tre s.r.l., offers comprehensive soluti… |
| 2026-07-25 | Center Of Information Technologies In Finance Public Institution | Centrul de Tehnologii Informaționale în Finanțe (CTIF) offers a wide r… |
| 2026-07-24 | Digital Edge | Digital Edge is a Managed Services Provider, skilled and accredited wi… |
| 2026-07-22 | VNSO | Công nghệ VNSO is a leading provider of cloud and server solutions in … |
| 2026-07-22 | Koperasi Karyawan PT Aplikanusa Lintasarta | Kopkarla.org is the website of KOPKARLA (Koperasi Karyawan PT Aplikanu… |
| 2026-07-22 | La Financière d'Orion (finorion) | Since 2009, we have been helping to create a privileged relationship b… |
| 2026-07-22 | Marpatech | Marpatech specializes in providing instrumentation and control solutio… |
| 2026-07-22 | Canal 9 Litoral | AHORA Entre Ríos is a news platform that provides the latest updates a… |
| 2026-07-22 | Tèrra Aventura | Tèrra Aventura is a free, app-based outdoor treasure hunt in France's … |
| 2026-07-20 | Jota Joias Premium | Jota Joias Premium is a Brazilian online jewelry retailer specializing… |
| 2026-07-20 | Koplarla | Koperasi Konsumen Karyawan PT Aplikanusa Lintasarta (KOPKARLA) was est… |
| 2026-07-20 | Jrd logistics | Jrd logistics LTD is an India-based freight forwarding and supply chai… |
| 2026-07-20 | Rumah Sakit Universitas Indonesia (RSUI) | Rumah Sakit Universitas Indonesia (RSUI) is the teaching hospital of t… |
| 2026-07-20 | Universidad Nacional de Mar del Plata | The Universidad Nacional de Mar del Plata offers a wide range of acade… |
| 2026-07-19 | Dephub | Directorate of Shipping and Maritime Affairs Jl. Medan Merdeka Barat N… |
| 2026-07-19 | meralmanisa | MER-AL was established in Turkey in 2005, but our experience in the au… |
| 2026-07-18 | FMZ Tecnologia em Sistemas | FMZ Tecnologia em Sistemas is a Brazilian software company that develo… |
| 2026-07-17 | Phi | PHI Studio focuses its activities on the presentation and curation of … |
| 2026-07-17 | Digipro | digipro.com.vn appears to be the website of DIGIPRO TECH JSC (Công ty … |
| 2026-07-17 | Integrated Marketing Services | Integrated Marketing Services is a company that operates in the Commer… |
| 2026-07-10 | Hynet | Hynet helps businesses protect and manage their most important asset: … |
| 2026-06-26 | NSW Rural Fire Service | Data Leaked, Updated from Nova Team by investigate Affiliate provided … |
| 2026-06-26 | vslmarine | VSL Marine Technology Pvt. Ltd. is an ISO 9001:2015 certified company … |
| 2026-06-24 | lpgroup | LP Group, founded in 2006, has already completed approximately 1 milli… |
| 2026-06-24 | alejandria | Alexandria is a platform that facilitates the development and implemen… |
| 2026-06-24 | transvill | Transvill SRL offers national and international road transport and log… |
| 2026-06-24 | transvill.com.pe | Transvill SRL offers national and international road transport and log… |
| 2026-06-24 | alejandria.biz | Alexandria is a platform that facilitates the development and implemen… |
| 2026-06-24 | lpgroup.pt | LP Group, founded in 2006, has already completed approximately 1 milli… |
| 2026-06-23 | cloudquantum | cloudquantum.co - software company that builds and delivers software s… |
| 2026-06-23 | FTL-Fast Transit Line | FTL International N.V. specializes in shipping, consolidation, forward… |
| 2026-06-21 | Lockers IT | LockersIT is a self-owned Bangladeshi IT company founded in 2013, head… |
| 2026-06-21 | Nhà Thành Phố | nhathanhpho.com.vn is an Vietnamese real estate listing platform opera… |
| 2026-06-20 | Dosab | Demirtaş Organize Sanayi Bölgesi (DOSAB) provides a range of services … |
| 2026-06-20 | Hosab | HOSAB, an organized industrial zone in Bursa, offers a range of servic… |
| 2026-06-20 | MIT HJERTE | Mit-hjerte.de Mit-hjerte.dk er en løsning, der giver mulighed for at m… |
| 2026-06-20 | One Believing Interiors | onebelieving.com One Believing is an interior design studio that speci… |
| 2026-06-19 | Desert Micro | DesertMicro.net is a Software & Internet based company located in Jack… |
| 2026-06-16 | Sunass | SUNASS is a public regulatory body established by Law Decree No. 25965… |
| 2026-06-16 | Kedah | The Kedah State Government operates an official corporate portal that … |
| 2026-06-15 | NSW Government | NSW Government is the administrative government for the state of New S… |
| 2026-06-15 | Divine IT | Divine IT Limited is a CMMI Level 3 IT consultancy and software develo… |
| 2026-06-15 | Sky devices | SKY Devices offers a diverse range of technology products including sm… |
| 2026-06-14 | Bandung | Balai Besar POM di Bandung is a regulatory body focused on the supervi… |
| 2026-06-09 | Trevi | The trevi.it website is the official brand portal for the Italian cons… |
| 2026-06-06 | Universitas Nasional | Universitas Nasional (UNAS) is an educational institution that offers … |
| 2026-06-05 | Aspire hospital | Both aspirehospitals.co.in and aspirehospitals.in Under Nova Company C… |
| 2026-06-02 | Everlite concept | Everlite Concept is a French company that specializes in polycarbonate… |
| 2026-06-02 | IBENA Textilwerke | IBENA HEIMTEX is a family-owned textile manufacturer based in Bocholt,… |
| 2026-05-30 | LTI Services and Larick Towing | ltiservices.com - laricktowing.com - LTI Services is a leading customi… |
// CONFIRMED ATTACKS
Nova confirmed attacks: 13 verified incidents
Ransomnews has verified 13 Nova incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2025 to June 2026. France accounts for 2 of them (15%), with victims recorded in 11 countries in total. The most affected sector is education, at 5 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 3; the outcome is unrecorded in the remaining 9. Where a figure was disclosed (2 cases), these incidents account for 941,180 exposed records.
13Verified incidents
11Countries
2025–2026Active range
25%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Nova incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2026 | NSW Rural Fire Service | Government | Sydney, Australia | — | Unknown | Source |
| June 2026 | Aspire Hospitals | Healthcare | Odisha, India | — | Unknown | Source |
| May 2026 | Wyższa Szkoła Biznesu - National Louis University | Education | Nowy Sącz, Poland | — | Unknown | Source |
| May 2026 | LTI Services and Larick Towing Inc. | Transportation | New Jersey, United States | — | Unknown | Source |
| May 2026 | Universitat de València | Education | València, Spain | — | No | Source |
| December 2025 | L'Epi du Rouergue | Food and Beverage | La Loubière, France | — | Unknown | Source |
| October 2025 | Regency Specialist Hospital | Healthcare | Johor Bahru, Malaysia | — | Unknown | Source |
| July 2025 | Clinical Diagnostics (Eurofins) | Healthcare | Rijswijk, Netherlands | 941,000 | Yes | Source |
| July 2025 | Ensemble Montplaisir | Education | Valence, France | — | Unknown | Source |
| June 2025 | Feng Chia University | Education | Taichung, Taiwan | — | Unknown | Source |
| May 2025 | Sun Moon University | Education | Asan, South Korea | — | No | Source |
| May 2025 | Comune di Pisa | Government | Pisa, Italy | — | No | Source |
| March 2025 | Pere Claver Grup | Healthcare | Barcelona, Spain | 180 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Nova's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.