Orange has shared several hypotheses for the attacks, including false flag operations meant to distract, strategic data theft operations doubled with revenue generation, and, more likely, a Chinese cyberespionage group "moonlighting" on the side to earn some money. The reason why Orange sees NailaoLocker as a rather basic ransomware is that, it does not terminate security processes or running services, it lacks anti-debugging and sandbox evasion mechanisms, and does not scan network shares. Compared to North Korean actors who are known to pursue multiple goals in parallel, including financial gains via ransomware attacks, Chinese state-backed actors haven't followed this approach, so the shift in tactics is concerning. Investigating deeper, Orange says they found some overlap between the content of the ransom note and a ransomware tool sold by a cybercrime group named Kodex Softwares (formerly Evil Extractor). The attacks exploited CVE-2024-24919, a Check Point Security Gateway vulnerability, to gain access to targeted networks and deploy the ShadowPad and PlugX malware, two families tightly associated with Chinese state-sponsored threat groups. Orange's researchers report that NailaoLocker is a relatively unsophisticated ransomware strain compared to the most prominent families in the space. A previously undocumented ransomware payload named NailaoLocker has been spotted in attacks targeting European healthcare organizations between June and October 2024. Only last week, Symantec reported about suspected Emperor Dragonfly (a.k.a. Bronze Starlight) operatives deploying RA World ransomware against Asian software firms and demanding a ransom of $2 million. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. Orange Cyberdefense CERT links the attacks to Chinese cyber-espionage tactics, though there's not enough evidence to attribute them to specific groups. The ransom note does not indicate that data was stolen, which is odd for most modern ransomware operations. "Written in C++, NailaoLocker is relatively unsophisticated and poorly designed, seemingly not intended to guarantee full encryption," mentions Orange.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 20 Feb 2025 08:20:17 +0000