Breaches

Nova Ransomware Group Claims Attack on KPMG, Threatens to Leak 500GB of Data

Zero Day Wire

— 1 min read
Share
Nova Ransomware Group Claims Attack on KPMG, Threatens to Leak 500GB of Data

The Nova ransomware group has claimed responsibility for an attack against KPMG, one of the Big Four professional services firms, threatening to release 500GB of stolen data if ransom demands are not met.

The listing appeared on Nova's dark web leak site on January 23, 2026, with a 10-day countdown timer. The group claims to have exfiltrated business services data and has provided samples as proof of compromise. A tree structure of the allegedly stolen files is also available for download.

KPMG provides audit, tax, and advisory services to many of the world's largest organizations. KPMG LLP North America operates as the independent U.S. member firm of KPMG International Cooperative.

Nova Ransomware Background

Nova, formerly known as RALord, is a fast-growing ransomware-as-a-service operation that emerged in late 2024. The group employs double-extortion tactics—encrypting victim systems while exfiltrating data to pressure payment.

The operation heavily targets the IT, technology, manufacturing, and healthcare sectors, with previous victims in the UAE, France, Singapore, and the United States.

KPMG has not publicly confirmed the incident. This story will be updated if additional information becomes available.

Read more

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

A compromised version of the Nx Console extension — a popular VS Code plugin with over 2.2 million installations — was published to the Visual Studio Code Marketplace after an attacker leveraged stolen developer credentials to inject a multi-stage credential stealer into the official nrwl/nx GitHub repository. The malicious version

By Zero Day Wire
Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Symantec and Carbon Black have published a definitive analysis confirming that Fast16, a Lua-based malware framework first surfaced by SentinelOne weeks ago, was purpose-built to sabotage nuclear weapons testing simulations. The findings establish Fast16 as the earliest known cyber sabotage tool targeting nuclear weapons research — predating the first known version

By Zero Day Wire