Check Point’s telemetry revealed exploitation attempts beginning in April 2024, with threat actors using stolen credentials to authenticate via VPNs and masquerading as legitimate users. Check Point’s incident response team continues to collaborate with CERTs to disrupt C2 infrastructure, though the persistence of ShadowPad’s plugins suggests long-term risks require continuous vigilance. A cyber attack leveraging Check Point’s patched CVE-2024-24919 vulnerability has targeted organizations across Europe, Africa, and the Americas. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The intrusion chain, which deploys the ShadowPad backdoor and NailaoLocker ransomware, exploits unpatched VPN gateways to infiltrate critical infrastructure, primarily in manufacturing sectors. ShadowPad’s modular architecture, decrypted in memory using XOR-based algorithms, supported multiple command-and-control (C2) protocols, including HTTP(S) and UDP, with encrypted payloads. A critical vulnerability tracked as CVE-2024-48248, has been discovered in the Nakivo Backup & Replication tool, exposing systems to unauthenticated arbitrary file read attacks. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Notably, NailaoLocker’s loader (NailaoLoader.dll) abused legitimate binaries like usysdiag.exe to sideload payloads, a tactic overlapping with Southeast Asian cybercrime groups. Security analysts have observed direct linkages to Chinese state-sponsored threat actors. The use of CVE-2024-24919 months after patching highlights systemic vulnerabilities in legacy VPN infrastructures, particularly in manufacturing sectors with delayed update cycles. Compromised endpoints often bore default hostnames like DESKTOP-O82ILGG, matching patterns observed in prior Chinese operations. This backdoor created persistence through Windows services and registry keys while exfiltrating system metadata like hostnames and private IPs. In a subset of incidents, attackers deployed NailaoLocker ransomware via ShadowPad’s execution framework. Its core design included logging failed encryption attempts and a hardcoded mutex (Global\lockv7) to prevent re-infection.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 28 Feb 2025 14:05:04 +0000