Nova Ransomware Recovery: The Rust Encryptor Formerly RALord
Nova started in early 2025 under the name RALord and rebranded in April 2025. It runs as a ransomware-as-a-service, with affiliates keeping most of each ransom, and by mid-2026 its leak site listed around 180 victims across 38 countries. ransomware.live shows it still posting victims in 2026.
How the encryptor works
The encryptor is written in Rust. According to AttackIQ and other researchers, it uses XChaCha20-Poly1305 with RSA-2048 key protection, appends a random-looking extension such as .xgWLckNV, tries several ways to switch off Microsoft Defender, kills security processes and deletes Volume Shadow Copies. It also checks for analysis tools and quits if it finds them.
Deleting shadow copies removes Windows' own way back. It does not change what is inside the encrypted files, and that is where recovery starts.
What we recover in Nova cases
We examine the encrypted SQL Server and Oracle databases, VMware and Hyper-V virtual disks, Veeam backups and NAS volumes directly, measure which regions were encrypted, and rebuild what is intact. Large files are where most usable data usually survives. We have solved many cases like this.
Keep the encrypted files and a copy of them, do not rebuild the servers yet, and contact us for a free assessment. No data, no charge.
Veeam backups, SQL Server or Oracle databases encrypted by Nova?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
Facing this problem? Contact us now.
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST