Nova Ransomware Strikes Five Victims in Five Days, Including Russian Oil & Gas Firm The Nova ransomware group escalated its activity between May 22 and 26, 2026, listing five victims across four continents in a rapid, geographically diverse campaign. The latest disclosures Eriell, a Russian oil and gas engineering firm, and sandox info, a technology company followed earlier attacks on Spain’s University of Valencia (May 23), Brazil’s SECONT (May 24), and Turkey’s Adensa Teknoloji (May 24). With 122+ victims claimed since its inception, Nova’s recent surge stands out for its breadth and speed. The group’s targeting of Eriell, a Russian-headquartered company, defies the common ransomware practice of avoiding domestic entities due to prosecution risks. Possible explanations include Nova’s affiliates operating outside Russia or the firm’s international operations making it a viable target despite its Russian base. The breach of Eriell poses significant risks, given the sensitivity of its data including project engineering documents, geological surveys, client contracts with national oil companies, and procurement records. Meanwhile, sandox info’s exposure could create supply chain vulnerabilities, as technology firms often hold source code, client credentials, and software license data. Nova’s consecutive-day posting pattern suggests a multi-affiliate operation, with attacks executed in parallel rather than sequentially. The campaign’s geographic spread spanning Europe, South America, the Middle East, and Russia highlights the group’s expanding reach and willingness to target sectors typically avoided by other ransomware actors.