Russian cybersecurity firms have released reports detailing a large-scale information-stealing campaign targeting local organizations using Nova malware. Nova is a commercial stealer sold on dark web marketplaces, priced from $50 for a monthly license to $630 for lifetime access. Nova is a variant of the widely used SnakeLogger malware, known for its capabilities in capturing saved authentication data, recording keystrokes, taking screenshots, and extracting clipboard data. To infiltrate victims’ devices, hackers use phishing emails with malicious files disguised as zipped archives. These emails are crafted to appeal to employees managing large volumes of emails, increasing the chances of infection. The origin of Nova’s development remains uncertain, though its code contains Polish strings, and a Telegram group promoting it was established in August 2024. The exact impact and objectives of the Nova malware campaign in Russia are still unclear. However, the data harvested through Nova could facilitate targeted ransomware attacks and other malicious activities, posing a significant threat to the affected sectors. The campaign comes amidst a backdrop of increased cyberattacks on Russian entities, often attributed to politically motivated, state-sponsored hackers, especially in light of the ongoing war in Ukraine and sanctions against Moscow. With Western cybersecurity companies pulling out of Russia, local firms have become primary sources of threat intelligence, though their reports often lack the independent verification typical of international researchers.