Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Inactive · #191 by victimsRansomware group

RALord

As of Oct 19, 2026, RALord has listed 15 confirmed victims on its leak site since Mar 22, 2025, 0.0% of all victims tracked by Brandefense. Its most targeted country is Brazil (13.3% of its victims) and its most targeted sector is Food and Beverage.

RALord is a ransomware group identified in March 2025 operating within the NOVA RaaS platform, targeting healthcare, education, hospitality, and IT sectors across multiple continents, using a Rust-based payload with an 85/15 affiliate revenue split; it later rebranded as "Nova."

Is My Company Listed?Follow RALordRequest IOC FeedTTPs, CVEs and malware →

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
15
Rank By Victims
#191
Last Leak-Site Post
Apr 27, 2025
Top Country
Brazil
Top Sector
Food and Beverage

Victims Posted Per Month.

RALord confirmed victims per month
MonthConfirmed victims
March 20255
April 202510
May 20250
June 20250
July 20250
August 20250
September 20250
October 20250
November 20250
December 20250
January 20260
February 20260
March 20260
April 20260
May 20260
June 20260
July 20260
August 20260
September 20260
October 2026 (month in progress)0
Updated continuously · figures as of Oct 19, 2026

Latest RALord Victims.

Search all 15 →
Latest confirmed leak-site victims claimed by RALord
VictimCountryIndustryData claimedPosted
DIALLOG companyCACanadaUnknownNot stated
HELUKABEL companyDEGermanyUnknownNot stated
rawafid companySASaudi ArabiaUnknownNot stated
agromate companyMYMalaysiaUnknownNot stated
bettininformatica - suporteon companyBRBrazilUnknownNot stated
Bio-Clima ServiceITItalyUnknownNot stated

How They Operate.

RALord's threat actor profile lists 1 malware and tools, with its targets and related actors.

TTPs, CVEs and malware →

Who RALord Targets.

Sectors

  1. Food and Beverage213.3%
  2. Education and Research16.7%
  3. Manufacturing16.7%

Countries

  1. BRBrazil213.3%
  2. SASaudi Arabia213.3%
  3. ARArgentina16.7%
  4. CACanada16.7%
  5. DEGermany16.7%
Shares are of this group's confirmed victims.

History.


  1. First seen in Brandefense data

  2. First confirmed victim listed on its leak site

  3. Busiest month on record: 10 confirmed victims

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.