ralord
First seen March 26, 2025Active19 claimed victims
The claims below are reproduced as posted by ralord on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
RALord is a ransomware group identified in March 2025 operating within the NOVA RaaS platform, targeting healthcare, education, hospitality, and IT sectors across multiple continents, using a Rust-based payload with an 85/15 affiliate revenue split; it later rebranded as "Nova."
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| DIALLOG company | April 27, 2025 | ransomware_live | — |
| rawafid company | April 23, 2025 | ransomware_live | — |
| HELUKABEL company | April 23, 2025 | ransomware_live | — |
| agromate company | April 22, 2025 | ransomware_live | — |
| Bio-Clima Service | April 16, 2025 | ransomware_live | — |
| bettininformatica - suporteon company | April 16, 2025 | ransomware_live | — |
| NewHotel cloud company | April 15, 2025 | ransomware_live | — |
| ARRCO LSM | April 15, 2025 | ransomware_live | — |
| Al-Hejailan Group | April 14, 2025 | ransomware_live | — |
| hasbco Company | April 10, 2025 | ransomware_live | — |
| Formosa Chang | March 30, 2025 | ransomware_live | — |
| pereclaver.org | March 28, 2025 | ransomware_live | — |
| Pere Claver grup | March 28, 2025 | ransomware_live | — |
| ihara.com.br | March 27, 2025 | ransomware_live | — |
| Ihara company | March 27, 2025 | ransomware_live | — |
| ec-nantes.fr | March 25, 2025 | ransomware_live | — |
| Élan Sportif Nantes | March 25, 2025 | ransomware_live | — |
| tomioingenieria.com.ar | March 22, 2025 | ransomware_live | — |
| Tomio Ingeniería | March 22, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).