Loading malware…
NailaoLocker is a targeted Windows ransomware family associated with the Green Nailao intrusion cluster and observed in attacks against European organizations, particularly in the healthcare sector, during 2024. It has been deployed in post-compromise phases following exploitation of perimeter infrastructure, including Check Point gateway vulnerabilities, and has been linked with intrusions involving the PlugX and ShadowPad backdoors. Reporting has assessed the broader activity as aligning with tradecraft commonly seen in Chinese intrusion sets, although public attribution to a specific threat group remains unconfirmed.
The ransomware is delivered through a DLL side-loading chain that abuses a legitimate signed executable to load a malicious DLL, often referred to as NailaoLoader. The loader validates the host executable, patches its code flow in memory, decrypts an encrypted payload using XOR, maps the decrypted NailaoLocker binary in memory, and transfers execution to the ransomware entry point. This execution method obscures the control flow and reduces straightforward detection of the final payload.
Once executed, NailaoLocker encrypts files using multi-threaded AES-256-CBC routines, appends a distinct locked-file extension, and drops customized HTML ransom notes. It excludes system-critical files and directories to preserve system stability during encryption, creates a mutex to prevent re-execution, records activity in a local log, hides encrypted files, and attempts to remove the loader DLL to reduce forensic artifacts. The malware also uses the Chinese SM2 elliptic-curve standard to protect AES keys. Analysis has noted an embedded decryption routine that appears nonfunctional in observed samples, an unusual characteristic for ransomware.
NailaoLocker appears in intrusions where ransomware deployment may have served both extortion and concealment objectives. Some assessments have suggested the ransomware could have been used to mask espionage-motivated operations behind a financially motivated incident. High-confidence reporting supports its role as a ransomware payload delivered after established access and post-exploitation activity rather than as a commodity mass-distributed strain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Two years ago, the cybersecurity agency flagged another flaw (CVE-2024-24919) in Check Point's Quantum Security Gateways as actively exploited by ransomware gangs, confirming an Orange Cyberdefense CERT report linking it to NailaoLocker ransomware attacks.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence and stealth are enhanced by mutex creation (Global\lockv7) to avoid re-execution, and the malware attempts to clean up after itself by deleting the loader DLL post-infection.
reads the encrypted usysdiag.exe.dat file from the disk, decrypts it using a XOR key
NaiLaoLocker logs activity to a file (lock.log) in the ProgramData directory and makes encrypted files hidden.
load_decrypt_exec_locker_func() function which is the main function which reads the encrypted usysdiag.exe.dat file from the disk, decrypts it using a XOR key and then maps the decrypted NailaoLocker binary in memory and transfers the control flow to the binary's entrypoint
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family linked to exploitation of Check Point Quantum Security Gateways vulnerability CVE-2024-24919, mentioned as historical background.
A ransomware family tied to exploitation of Check Point Quantum Security Gateways, with distribution involving ShadowPad and PlugX backdoors.
Ransomware linked to exploitation of Check Point Quantum Security Gateways vulnerability CVE-2024-24919.
Ransomware family referenced as an associated analytic story for detection of common ransomware file extensions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.