Analyzing Nova Ransomware: A Rust-Based Encryptor with Multi-Layered Microsoft Defender Evasion Techniques

Key takeaways

Nova implements a multi-layered defense evasion strategy, combining Microsoft Defender configuration changes, service manipulation, registry modifications, and process termination to weaken host-based security controls.
The ransomware incorporates anti-analysis techniques by enumerating running processes and terminating execution if common reverse engineering, debugging, or monitoring tools are detected.
Recovery is actively inhibited through the deletion of Volume Shadow Copies using both vssadmin and WMI.
Nova encrypts files using a hybrid cryptographic scheme based on XChaCha20-Poly1305 and RSA-2048, appends the .xgWLckNV extension, drops the README_NOVA.me ransom note, and performs self-deletion upon completion.

AttackIQ has created and released a new assessment that emulates the Tactics, Techniques, and Procedures (TTPs) associated with the deployment of Nova ransomware to help customers validate their security controls and their ability to defend against this threat.

Validating your security program performance against these behaviors is vital in reducing risk. By using this new emulation in the AttackIQ Adversarial Exposure Validation (AEV) Platform, security teams will be able to:

Evaluate security control performance against baseline behaviors associated with Nova ransomware.
Assess their security posture against an opportunistic adversary, which does not discriminate when it comes to selecting its targets.
Continuously validate detection and prevention pipelines against a playbook similar to those used by groups currently focused on ransomware activities.

Threat Overview

Nova is an active Ransomware-as-a-Service (RaaS) operation that emerged in early 2025 under the name RALord before rebranding to Nova in April 2025. According to statements published by the operators, the name change followed contact from the RAWorld ransomware group after Nova declined a proposal to collaborate. The operation follows a double-extortion model, combining data encryption with the theft of sensitive information and threatening to publish stolen data through its dedicated data leak site if ransom demands are not met. Public reporting has also suggested that Nova may be derived from the Babuk source code leaked in 2021, although this relationship has not been independently confirmed.

As of July 2026, the Nova leak site has listed approximately 180 victims across 38 countries, demonstrating a broad geographic reach and an opportunistic targeting strategy. The technology sector has been the most frequently targeted, followed by manufacturing, healthcare, education, and professional services, although organizations across numerous other industries have also been impacted.

This report presents the findings of AttackIQ’s internal analysis of the Nova ransomware payload, examining its execution flow, defense evasion techniques, recovery inhibition mechanisms, command-line capabilities, and encryption process.

Sample Overview

Artifact: Nova Encryptor
Hash (SHA-256): 1231d0b6cbba77151037fc117bcfbf9406e127e86407c1728a478a7a628bc4f3
Type: 64-bit Windows executable
Ransom note filename: README_NOVA.me
Encrypted file extension: .xgWLckNV (per-build, not a fixed family-wide extension)
Extensions skipped during encryption: exe, me, xgWLckNV, worker

The analyzed sample is a 64-bit Windows executable written in Rust with a file size of 721 KB. The PE header includes a compilation timestamp of February 3, 2026. Additionally, the binary retains Rust source path strings referencing C:\Users\scorp\.cargo\registry\..., suggesting that scorp may have been the username of the Windows account used during the build process.

Command-Line Arguments

Nova supports multiple command-line arguments that allow affiliates to customize its execution.

Command	Behavior
win-def-kill	Disables Microsoft Defender
del-shdw-cp	Deletes Volume Shadow Copies
worker	Spawns encryption worker threads
encrypt-all	Encrypts all files in the system
encrypt-path	Encrypts files under specified path
readme-add	Drops the ransom note
readme-add-all	Drops the ransom note across all directories
delete-logs	Deletes Event Logs
kill-edr	Terminates hardcoded AV/EDR processes
kill-process	Terminates a specified process passed as a command-line argument
help	Open helper

Execution walkthrough

Process Enumeration

As part of its initial execution flow, Nova enumerates running processes using the native tasklist utility. The malware compares the obtained process list against a hardcoded list of applications commonly used for reverse engineering, debugging, and system monitoring. If any of these processes are detected, Nova immediately terminates execution, likely to hinder analysis and prevent researchers from observing its behavior.

ollydbg.exe x64dbg.exe idaq.exe idaq64.exe wireshark.exe procmon.exe processhacker.exe

Event Log Clearing

To hinder forensic analysis and reduce detection opportunities, Nova clears Windows Event Logs using multiple native Windows mechanisms. It leverages the PowerShell cmdlets Get-EventLog and Clear-EventLog to enumerate and clear legacy event logs, while also using Get-WinEvent together with the .NET EventLogSession.ClearLog() method to remove entries from modern Windows Event Log channels. Additionally, Nova invokes the native wevtutil clear-log command to clear the Application, Security, System, Setup, ForwardedEvents, Windows PowerShell, and Microsoft-Windows-PowerShell/Operational event logs.

Get-EventLog -List | ForEach-Object { Clear-EventLog -LogName $_.log } Get-WinEvent -ListLog * | Where-Object { $_.RecordCount -gt 0 } | ForEach-Object { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName)} wevtutil clear-log

Microsoft Defender Evasion

To reduce the likelihood of detection during execution, Nova employs multiple techniques to weaken Microsoft Defender. It leverages the PowerShell cmdlets Set-MpPreference, Add-MpPreference, and Set-ItemProperty, in addition to service control commands and registry modifications, to disable or bypass built-in security protections.

First, Nova invokes Set-MpPreference to disable real-time monitoring, behavior monitoring, IOAV protection, script scanning, archive scanning, intrusion prevention system, removable drive scanning, Block at First Sight, network file scanning, and mapped network drive scanning. It also configures Microsoft Defender to allow (rather than block or quarantine) detections across all threat severity levels, effectively preventing automated remediation. Finally, Nova uses Add-MpPreference -ExclusionPath to add each enumerated drive as a Microsoft Defender exclusion, preventing files on those volumes from being scanned.

Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableBehaviorMonitoring $true Set-MpPreference -DisableIOAVProtection $true Set-MpPreference -DisableScriptScanning $true Set-MpPreference -DisableArchiveScanning $true Set-MpPreference -DisableIntrusionPreventionSystem $true Set-MpPreference -DisableRemovableDriveScanning $true Set-MpPreference -DisableBlockAtFirstSeen $true Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true Set-MpPreference -DisableScanningNetworkFiles $true Set-MpPreference -LowThreatDefaultAction Allow -ModerateThreatDefaultAction Allow -HighThreatDefaultAction Allow -SevereThreatDefaultAction Allow Add-MpPreference -ExclusionPath

After configuring Microsoft Defender preferences, Nova attempts to disable Microsoft Active Protection Service (MAPS, formerly known as SpyNet), Microsoft’s cloud-based protection service that provides file reputation lookups, cloud-assisted detections, and automatic sample submission for further analysis. One notable implementation detail is that Nova attempts to modify the SpyNetReporting and SubmitSamplesConsent registry values under the Real-Time Protection subkey, whereas these settings are normally stored under the SpyNet subkey. As a result, these modifications do not affect Microsoft Defender’s MAPS configuration. Furthermore, Nova sets SubmitSamplesConsent to 0 (Always prompt) rather than 2 (Never send), meaning automatic sample submission is not explicitly disabled and instead requires user consent.

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SpyNetReporting -Value 0 Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SubmitSamplesConsent -Value 0

The ransomware also attempts to weaken Microsoft Defender by modifying the DisableAntiSpyware and TamperProtection registry values via Windows API RegSetValueExW. These modifications are intended to disable Microsoft Defender Antivirus and alter Tamper Protection settings, complementing Nova’s broader effort to reduce host-based security protections prior to executing its ransomware operations.

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features TamperProtection =0

Finally, Nova interacts directly with the WinDefend service, executing sc stop WinDefend to stop the service and sc config WinDefend start=disabled to configure it with a disabled startup type, aiming to prevent Microsoft Defender Antivirus from restarting automatically after a reboot.

sc stop WinDefend sc config WinDefend start=disabled

Volume Shadow Copy Deletion

To inhibit system recovery, Nova first enumerates the system’s logical drives using the Windows Management Instrumentation (WMI) command-line utility. It then deletes Volume Shadow Copies from each discovered volume by executing the native vssadmin utility, using both the /all and /oldest options combined with /quiet. Additionally, Nova invokes wmic to delete shadow copies through WMI without requiring user confirmation.

wmic logicaldisk get name vssadmin delete shadows /for /all /quiet vssadmin delete shadows /for /oldest /quiet wmic shadowcopy delete /nointeractive

Security Process Termination

Nova attempts to impair security defenses by terminating antivirus (AV) and endpoint detection and response (EDR) processes. The ransomware leverages taskkill, Windows Management Instrumentation (WMI), and PowerShell’s Stop-Process cmdlet to terminate processes associated with security products identified through a hardcoded list. The targeted processes include components from Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, McAfee, Sophos, Cylance, Kaspersky, Symantec, and other security solutions. Additionally, Nova supports terminating user-specified processes, allowing it to disrupt applications that may interfere with its execution.

See the full list of targeted processes in the Appendix section

taskkill wmic process where name="" delete Stop-Process -Name -Force

Encryption

Nova encrypts victim files using a hybrid cryptographic scheme that combines XChaCha20-Poly1305 for file encryption with RSA-2048 to protect the generated encryption keys. During the encryption process, the ransomware appends the .xgWLckNV extension to encrypted files while excluding files with the extensions .exe, .me, .xgWLckNV, and .worker from encryption. Upon completion, Nova drops a ransom note named README_NOVA.me in affected directories, providing victims with instructions for contacting the operators and recovering their data.

Self-Deletion

Upon completion of the encryption process, Nova performs a self-deletion routine to remove its executable from the compromised system, reducing the number of artifacts available for post-incident investigation.

Emulating Nova Ransomware

The behaviors described above have been operationalized into an AttackIQ attack graph that reproduces the encryptor’s observed execution flow, enabling teams to validate detection and prevention capabilities across a realistic attack chain rather than isolated events.

Stage 1: Initial Access & Discovery – Nova Ransomware Deployment

Nova first calls IsDebuggerPresent to determine whether it is executing in a debugging environment. It then enumerates running processes using tasklist to identify security, monitoring, and reverse-engineering tools. If any of the targeted processes are detected, the malware terminates execution to evade analysis and avoid execution in monitored environments.

Stage 2: Defense Evasion – Disable Microsoft Defender

In this stage, Nova attempts to weaken Microsoft Defender by disabling multiple security features through PowerShell and registry modifications. Using the Set-MpPreference cmdlet, the malware disables real-time protection, behavior monitoring, script scanning, I/O antivirus protection, archive scanning, removable drive scanning, Block at First Sight, and the scanning of network drives and files. It also configures all Microsoft Defender threat severity levels to Allow, preventing automatic remediation of detected threats.

Nova further attempts to modify Defender-related registry settings, including DisableAntiSpyware, TamperProtection, SpyNetReporting, and SubmitSamplesConsent, to reduce protection and interfere with cloud-based security features. Finally, it adds the “%TEMP%\aiq-temp-exclusion\” directory path to the Microsoft Defender exclusion list using Add-MpPreference -ExclusionPath.

Stage 3: Impact – Nova File Encryption

In this stage, Nova prepares the environment for encryption by removing recovery mechanisms and identifying accessible storage locations. The malware clears Windows Event Logs using PowerShell, the GlobalSession.ClearLog method, and wevtutil.exe to reduce forensic visibility. It then enumerates logical drives via WMI and deletes Volume Shadow Copies using both vssadmin.exe and wmic.exe, preventing recovery through Windows backup snapshots. Subsequently, Nova traverses the file system using the FindFirstFileW and FindNextFileW APIs to identify files for encryption. Finally, it encrypts targeted files using XChaCha20-Poly1305 and RSA-2048 to protect the encryption keys, appending the .xgWLckNV extension to the encrypted files.

Scope note. AttackIQ adversary emulations are built to run safely in live production environments. Accordingly, we deliberately exclude any behavior identified during analysis that is destructive, that affects systems beyond the test host, or that cannot be cleanly reversed. These behaviors are characterized in our analysis but intentionally left out of the emulation, since reproducing them in a customer environment would defeat the purpose of a safe, repeatable test.

Wrap Up

In summary, this emulation will evaluate security and incident response processes and support improvements to your security control posture against the behaviors exhibited by Nova ransomware. With data generated from continuous testing and use of this assessment template, you can focus your teams on achieving key security outcomes, adjust your security controls, and work to elevate your total security program effectiveness against a known and dangerous threat. AttackIQ is the industry’s leading Continuous Threat Exposure Management (CTEM) platform, enabling organizations to measure true exposure, prioritize risk, and disrupt real-world attack paths. By moving beyond static vulnerability data, AttackIQ operationalizes CTEM by continuously validating exposures against real adversary behavior and defensive controls. The platform connects vulnerabilities, configurations, identities, and detections into adversary-validated attack paths—quantifying the likelihood of attacker movement and impact. This evidence-based approach empowers security leaders to focus on what matters most, optimize defensive investments, and strengthen resilience through threat-informed, AI-driven security operations.

Appendix

Targeted Process List

MsMpEng.exe NisSvr.exe SecurityHealthService.exe Sense.exe CSFalconService.exe SentinelDynamicEngine.exe carbonblack.exe cb.exe McAfeeEndpointSecurity.exe Mcshield.exe mfemms.exe SophosUI.exe SophosFS.exe SophosHealth.exe CylanceSvc.exe CylanceUI.exe firewall.exe avp.exe ksde.exe kavfs.exe symantec.exe sep.exe SavService.exe bdagent.exe vsserv.exe

Full Command Table

tasklist

wevtutil clear-log Application wevtutil clear-log Security wevtutil clear-log System wevtutil clear-log Setup wevtutil clear-log ForwardedEvents wevtutil clear-log Windows PowerShell wevtutil clear-log Microsoft-Windows-PowerShell/Operational