Summary:
An unidentified threat actor has been observed targeting European organizations, notably in the healthcare sector, with an undocumented C++ ransomware strain, dubbed NailaoLocker. The campaign, tracked as Green Nailao, was uncovered by Orange Cyberdefense CERT and initiated between June and October last year. The initial access vector typically involves the compromise of a Check Point VPN appliance, which researchers attribute to the exploitation of CVE-2024-24919, a critical zero-day vulnerability affecting Check Point Security Gateways with Remote Access VPN or Mobile Access features enabled. Although CVE-2024-24919 was patched in May 2024, it has been actively exploited in the wild since early April 2024. This vulnerability allows attackers to read specific information on the gateways, most notably enabling them to enumerate and extract password hashes for all local accounts. These stolen credentials can then be leveraged to gain access to the VPN, serving as an initial foothold into organizational networks.

Security Officer Comments:
While NailaoLocker ransomware has been developed in the attacks observed thus far, the primary objective of the latest campaign appears to be cyberespionage rather than financial gain. According to Orange, NailaoLocker is relatively unsophisticated and poorly designed, with no clear intention to ensure full encryption. In contrast to other ransomware variants, NailaoLocker does not:

• Scan network shares
• Terminate services or processes that might obstruct the encryption of critical files
• Monitor for debugging attempts

These design flaws suggest that its purpose is less about extortion and more aligned with covert surveillance or data exfiltration. Notably, Orange has observed the deployment of two implants—PlugX and ShadowPad—both of which are frequently linked to Chinese-affiliated threat actors. PlugX is a remote access Trojan that provides backdoor access to victim systems, allowing attackers to remotely monitor victim activity and deploy additional payloads of interest. ShadowPad, a modular backdoor, has been suspected of being privately shared or sold among Chinese APT groups since 2015. It is widely used in cyberespionage campaigns targeting government entities, academic institutions, energy organizations, think tanks, and technology companies. According to Orange, the ShadowPad variant identified in the latest campaign is heavily obfuscated and leverages Windows services and registry keys to maintain persistence on the system, even after a reboot.

Suggested Corrections:
Organizations should take immediate action to address CVE-2024-24919 by ensuring that all affected Check Point VPN appliances are patched with the May 2024 update. Additionally, robust network segmentation and least-privilege access policies should be implemented to limit lateral movement and reduce impact in the event of a potential attack. Organizations should also enforce multi-factor authentication and implement endpoint security to detect and block the execution of backdoor implants like PlugX and ShadowPad.

Link(s):
https://www.orangecyberdefense.com/...ed-in-europe-by-shadowpad-and-plugx-backdoors