Wednesday, October 7, 2026

@StableBread Oct 3

Fajasy on X

The ransomware software of Nubeva Technologies $NBVAF (TSXV: $NBVA) passed every test in a month-long third-party lab evaluation in 2023, and its biggest customer, Kroll, walked away anyway. In January 2022, Nubeva launched Ransomware Reversal, or NuRR, the product the company is now built around. It’s a lightweight agent installed on servers, desktops, and laptops that watches for the file encryption a ransomware attack produces, captures copies of the encryption keys as the malware generates them, and stores those keys on the customer’s own network. After the attack, Nubeva uses the captured keys to build a decryptor (a program that reverses the encryption) and hands the customer its data back, without the ransom. The only outside test of NuRR I found was a month-long evaluation in 2023 at DreamPort, a lab in Maryland (the test doesn’t appear to have been commissioned by Nubeva). DreamPort is run by the Maryland Innovation and Security Institute (MISI), a nonprofit that partners with U.S. Cyber Command to connect the military with outside cybersecurity products. Per Nubeva’s July 20, 2023 release, NuRR passed all 17 tests in MISI’s test plan and captured the encryption keys in every attack, including ones using the LockBit, Ragnar Locker, and BlackBasta ransomware strains. But less than two months after the MISI results, Nubeva lost its biggest customer: → January 2023: Nubeva named Kroll, the risk advisory firm that runs more than 3,000 incident-response investigations a year, as a strategic partner using the product in its ransomware cases. → September 2023: Kroll ended the relationship and paid $180,000 to walk away. It had been 86% of FY2023 revenue (~$1.78M of $2.07M). Neither company gave a reason in a filing or press release. But in a July 2024 video on Nubeva’s YouTube channel, CEO Randy Chou said Kroll sometimes brought in 10 ransomware cases on the same weekend, and “neither the partner or us as a complete solution could handle the emergency services.” In an October 2025 video, he explained the constraint further. Each new ransomware variant needs its own decryptor, which Nubeva’s engineers built by hand. With 10 to 30 attacks running at once, “you don’t have enough engineers to go figure out the new decryptor.” Chou added that Nubeva “simply cannot afford to scale” its support, “and that’s still the reality,” so it’s waiting on automation before it grows again. A longtime investor I spoke with, who has followed Nubeva for years and has spoken with people who’ve used NuRR in the field, described the same constraint. He also says Kroll’s exit is why Nubeva stopped trying to grow on its own and bet on AI to write the decryptors.