Nova Ransomware Uses Rust and Layered Defender Evasion

Summary

Nova is a Rust-based Ransomware-as-a-Service (RaaS) operation that follows a double-extortion model. The malware uses advanced evasion techniques to disable Microsoft Defender, terminate security processes, and remove Volume Shadow Copies to prevent recovery. It encrypts victim files with a hybrid XChaCha20-Poly1305 and RSA-2048 encryption scheme.

Investigation

The investigation included an internal analysis of the Nova ransomware payload, focusing on its execution flow, defense evasion, and recovery inhibition techniques. Researchers identified command-line arguments, registry changes, and PowerShell cmdlets used to weaken host-based security controls. The analysis also uncovered Rust-based libraries and specific anti-analysis triggers embedded in the malware.

Mitigation

To reduce the risk of Nova ransomware, organizations should maintain secure offline backups and protect Volume Shadow Copies from unauthorized deletion. Microsoft Defender should be hardened through Group Policy to prevent malicious registry changes and PowerShell modifications. Monitoring suspicious use of utilities such as vssadmin, wmic, and wevtutil can also provide early warning of an intrusion.

Response

If Nova activity is detected, incident responders should immediately isolate affected systems to limit further encryption and data exfiltration. Investigators should identify the initial access vector and search for Nova ransom notes or associated encrypted file extensions. Security processes should also be monitored closely for unauthorized termination attempts throughout containment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and is performing environmental reconnaissance. To ensure the successful deployment of the Nova Ransomware payload, the attacker executes a PowerShell command to disable Microsoft Defender’s real-time monitoring. This “Living off the Land” approach uses a legitimate administrative tool to change security posture, aiming to bypass signature-based detection of the ransomware binary.

• Regression Test Script:

  # Simulation Script: Nova Ransomware Defense Evasion
  # This script executes the exact commands targeted by the Sigma rule.
  # Note: This requires administrative privileges to succeed.
  
  Write-Host "[!] Starting Nova Ransomware Evasion Simulation..." -ForegroundColor Red
  
  # 1. Attempt to disable Real-time Monitoring
  Write-Host "[*] Attempting to disable Real-time Monitoring..."
  Set-MpPreference -DisableRealtimeMonitoring $true
  
  # 2. Attempt to disable Behavior Monitoring
  Write-Host "[*] Attempting to disable Behavior Monitoring..."
  Set-MpPreference -DisableBehaviorMonitoring $true
  
  # 3. Attempt to add an exclusion path (e.g., C:Temp)
  Write-Host "[*] Attempting to add exclusion path..."
  Add-MpPreference -ExclusionPath "C:Temp"
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script: Restore Defender Protections
  # This restores the security settings to their default state.
  
  Write-Host "[!] Starting Cleanup..." -ForegroundColor Yellow
  
  Set-MpPreference -DisableRealtimeMonitoring $false
  Set-MpPreference -DisableBehaviorMonitoring $false
  Remove-MpPreference -ExclusionPath "C:Temp"
  
  Write-Host "[+] Cleanup complete. Defender settings restored." -ForegroundColor Green