Identification of Public Infrastructure Associated with the Nova Ransomware Group
By Threat Intelligence Unit
Executive Summary
- ARTHUR identified a public domain associated with Nova Clouds, a file distribution site operated by the Nova ransomware group
- The identified domain is hosted on a public commercial hosting platform that actively advertises its services across the open web and social media
- Nova Clouds hosts data exfiltrated from ransomware victims, including organizations in South Korea and internationally
- This report analyzes the dark web infrastructure operated by the Nova ransomware group and the associated public domain supporting its operations
Site Analysis
Nova Clouds is the dark web file distribution site operated by the Nova ransomware group.
The group operates three identified onion services:
- Nova Clouds — File distribution site
- Nova GBlog — Official link-tree site
- Nova Blog — Data leak site
Identified Onion Services
- Nova Clouds:
pifk3xu3vad6cuxsjll4qjomyaaaoyvnyqppro75pazadzctrrvpdnyd.onion - Nova GBlog:
novavdivko2zvtrvtllnq45lxhba2rfzp76qigb4nrliklem5au7czqd.onion - Nova Blog:
novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion
Figure 1. Nova Clouds website interface
Nova Clouds hosts data exfiltrated from organizations compromised by Nova ransomware and makes the files available for download.
Although the group primarily targets organizations outside South Korea, it has also targeted South Korean organizations, including a university and a company, in 2026.
South Korean Organizations
Data exfiltrated from a South Korean company was posted on Nova Clouds on May 17, 2026, and remains available for download.
Figure 2. Nova Clouds website interface showing leaked data of URG OEM
Data exfiltrated from a South Korean university was posted on Nova Clouds on May 30, 2026, and remains available for download.
Figure 3. Nova Clouds website interface showing leaked data of Daegu University AI Department
Organizations Outside South Korea
Data exfiltrated from various businesses and critical infrastructure organizations outside South Korea was also identified on Nova Clouds, all in June 2026.
These organizations included:
- An Australian fire and emergency service
- A U.S. mobile device manufacturer
- The Malaysian state government of Kedah
Figure 4. Nova Clouds website interface showing leaked data of NSW Rural Fire Service
Figure 5. Nova Clouds website interface showing leaked data of SKY Devices
Figure 6. Nova Clouds website interface showing leaked data of Kedah
Infrastructure Analysis
Public Domain Identification
Using the dark web intelligence platform ARTHUR, a public domain associated with Nova Clouds was identified.
- Public Domain:
14[REDACTED].impreza.host
Hosting Provider Analysis
A search for impreza[.]host on ARTHUR identified the onion service associated with the Impreza Host hosting provider.
The hosting service operates on both the open web and the dark web.
- Onion Service:
portal.imprezareshna326gqgmbdzwmnad2wnjmeowh45bs2buxarh5qummjad.onion - Clean Web Domain:
impreza.host
Figure 7. ARTHUR search results linking Nova Clouds infrastructure to Impreza Host
Impreza Host is a Seychelles-based offshore hosting platform that has operated since 2017.
The platform supports server infrastructure across multiple locations and offers a range of hosting services, including:
- WHOIS privacy protection
- Virtual private servers (VPS)
- Dedicated servers
- Web hosting
- Domain registration
According to publicly available information, the platform advertises several features that may appeal to privacy-focused customers, including:
- DMCA-ignored hosting
- Cryptocurrency payments (No KYC)
- Tor hosting
- DDoS protection
Figure 8. Impreza Host official website
In addition to its official website, the company actively promotes its services through a public social media platform.
Figure 9. Public search results identifying Impreza Host's social media presence
Conclusion
ARTHUR identified a public domain associated with Nova Clouds, the file distribution site operated by the Nova ransomware group.
Nova Clouds continues to host data exfiltrated from organizations in South Korea and internationally, including companies, universities, government organizations, and critical infrastructure organizations.
Infrastructure analysis identified the associated domain as operating through Impreza Host, a commercial hosting provider that maintains a presence across both the open web and the dark web. The provider publicly advertises services including offshore hosting, Tor hosting, cryptocurrency payments with no KYC requirements, and a DMCA-ignored policy.
The identification of publicly accessible infrastructure associated with Nova Clouds provides additional opportunities for tracking and monitoring ransomware-related infrastructure beyond Tor-based services.