NailaoLocker
NailaoLocker is a novel ransomware family observed in targeted intrusions. Reporting from Orange Cyberdefense and Fortinet links its deployment to campaigns that targeted European organizations, particularly in the healthcare sector, and in some cases followed exploitation of Check Point VPN/security gateway vulnerabilities, including CVE-2024-24919. Post-compromise activity associated with these intrusions included deployment of PlugX and ShadowPad before the ransomware was launched. SentinelOne also reported overlap between ShadowPad campaigns delivering NailaoLocker and broader China-nexus intrusion activity involving exploitation of Check Point gateway devices.
Technically, NailaoLocker is delivered via DLL side-loading using the legitimate signed binary usysdiag.exe to load a malicious sensapi.dll, which decrypts and executes the core payload. The ransomware performs multi-threaded file encryption using AES-256-CBC, appends the .locked extension to encrypted files, drops customized HTML ransom notes, excludes system-critical files and directories to preserve host stability, marks encrypted files as hidden, writes activity logs to ProgramData\lock.log, creates the mutex Global\lockv7 to prevent re-execution, and attempts to delete the loader DLL after infection to reduce artifacts. It also uses the Chinese SM2 elliptic curve standard to protect AES keys.
Analysis noted that NailaoLocker contains an embedded decryption routine, which is unusual for ransomware, but the routine was not operational in the analyzed sample with the hardcoded values present. Researchers assessed that the combination of Chinese malware loaders, ShadowPad/PlugX usage, and zero-day or n-day perimeter-device exploitation suggests possible links to Chinese state-sponsored actors or actors mimicking those tactics. The reporting further assessed that NailaoLocker may in some cases have been used not only for extortion but also to obscure espionage activity behind a ransomware incident.
High-confidence indicators and artifacts mentioned in the reporting include DLL side-loading via usysdiag.exe and sensapi.dll, the mutex Global\lockv7, the ProgramData\lock.log file, encrypted files with the .locked extension, and customized HTML ransom notes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Two years ago, CISA tagged another vulnerability (CVE-2024-24919) in Check Point's Quantum Security Gateways as actively exploited by ransomware gangs, confirming an Orange Cyberdefense CERT report linking it to NailaoLocker ransomware attacks.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
3 techniques
Stealth
Persistence and stealth are enhanced by mutex creation (Global\lockv7) to avoid re-execution, and the malware attempts to clean up after itself by deleting the loader DLL post-infection.
Discovery
1 technique
Discovery
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware linked to exploitation of Check Point Quantum Security Gateways vulnerability CVE-2024-24919.
Ransomware family referenced as an associated analytic story for detection of common ransomware file extensions.
Ransomware family listed in connection with a detection for rapid process termination behavior indicative of ransomware execution.
Ransomware deployed in some cases following intrusions that deployed PlugX/ShadowPad.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.