The Nova Ransomware Group has claimed a successful breach of Universitas Nasional, part of an aggressive expansion targeting high-value academic, government, and professional services sectors. Utilizing a double-extortion model, the threat actor prioritizes massive data exfiltration—with recent breaches of KPMG Netherlands and Universitat de València yielding between 300GB and 500GB of data. The campaign likely utilizes initial access via RDP brute-forcing or edge device exploitation, followed by lateral movement and exfiltration using tools like Rclone or FileZilla. This incident risks the exposure of student PII, faculty research, and administrative credentials, posing a significant threat of secondary extortion through dark web leak sites.

• Incident/Breach Overview

  • Nova Ransomware Group has confirmed a breach targeting Universitas Nasional in Indonesia.
  • The incident aligns with a broader trend of targeting educational institutions to leverage sensitive data.
  • Potential compromise involves student PII, faculty research, and critical administrative credentials.

• Attack Vector/Campaign Mechanics

  • Employs a double-extortion tactic, prioritizing high-volume data theft prior to payload deployment.
  • Initial access likely achieved via RDP brute-forcing, phishing, or exploitation of vulnerable edge devices.
  • Post-exploitation involves lateral movement and data staging for large-scale egress.
  • Exfiltration tools identified in similar campaigns include Rclone, FileZilla, and bespoke scripts.

• Threat Group Profile & Scale of Impact

  • Nova demonstrates an aggressive expansion strategy targeting diverse global sectors.
  • Recent high-impact victims include KPMG Netherlands (500GB exfiltrated) and Universitat de València (300GB exfiltrated).
  • Ransom demands are substantial, with reported figures for other victims reaching hundreds of thousands of dollars.
  • Secondary extortion via dark web leak sites serves as the primary mechanism for pressure.

• Indicators of Compromise (IoCs) & Defensive Posture

  • Monitor network traffic for anomalous outbound transfers and the presence of Rclone or FileZilla.
  • Audit system logs for evidence of data staging and unauthorized lateral movement.
  • Enforce strict multi-factor authentication (MFA) and limit RDP access to hardened VPN endpoints.
  • Prioritize rapid patch management for all internet-facing edge devices and gateway appliances.

• Conclusion

  • The Universitas Nasional attack highlights the vulnerability of the academic sector to targeted ransomware.
  • Organizations must shift focus toward data-centric security and rigorous egress monitoring.
  • Early detection of exfiltration-related tools is critical to preventing total data loss.