NxRansomware

NxRansomware is a publicly available ransomware/encryption tool. In the provided reporting, it is not described as a bespoke malware family but as one of several publicly available encryption tools that DPRK state-sponsored ransomware actors have been observed using or possessing. The activity is discussed in the context of DPRK ransomware operations targeting U.S. and South Korean healthcare organizations and other critical infrastructure entities. The broader campaigns described used initial access via exploitation of known vulnerabilities including Log4Shell (CVE-2021-44228), SonicWall SMA100 (CVE-2021-20038), and TerraMaster TOS (CVE-2022-24990), as well as Trojanized X-Popup messenger files distributed via xpopup.pe[.]kr and xpopup[.]com. After compromise, the actors used staged payloads and customized malware for reconnaissance, file transfer, command execution, and victim data collection/exfiltration before deploying ransomware and demanding bitcoin payment, sometimes communicating via Proton Mail and at times impersonating other ransomware groups such as REvil. High-confidence indicators in the reporting are tied to the broader DPRK activity rather than specifically to NxRansomware, including xpopup.pe[.]kr, xpopup[.]com, IPs 115.68.95[.]128 and 119.205.197[.]111, and MD5 1f239db751ce9a374eb9f908c74a31c9 for a malicious xpopup.rar file.