MortalKombat Ransomware Has Ties to Xorist to Steal Cryptocurrency

Starting from December 2022, researchers with Cisco Talos have been monitoring an unknown entity that has been using two pieces of recently discovered malicious software - MortalKombat ransomware and a GO variant of Laplas Clipper malware - to steal cryptocurrency from its victims.

The attackers were seen scanning the internet for vulnerable machines with an exposed remote desktop protocol on port 3389, using a download server that runs an RDP crawler and also facilitates the MortalKombat ransomware. Based on the analysis of the code, class name, and registry key strings, Talos believes that MortalKombat ransomware is a part of the Xorist family.

The attackers have been targeting individuals, small and large businesses, and demanding ransom payments in cryptocurrency, which provides them with several benefits, such as anonymity, decentralization, and lack of regulation, making it difficult to track them. Talos suggests that users and organizations should be careful while performing cryptocurrency transactions and pay attention to the recipient's wallet address.

It also recommends updating computers with the latest security patches, deploying robust endpoint protection solutions with behavioral detection capabilities, and keeping tested, offline backup solutions for endpoints with a reasonable restoration time in case of a ransomware attack.

MortalKombat Infection Chain

In this particular campaign, a phishing email is used as the initial infection vector, which triggers a complex attack chain where the attacker deploys either ransomware or malware, and then removes all traces of malicious activity to avoid detection and analysis.

The phishing email contains a malicious ZIP file that includes a BAT loader script. When the victim runs the script, it downloads another harmful ZIP file from a server controlled by the attacker, automatically unzips it, and runs the payload, which could be either the GO variant of Laplas Clipper malware or MortalKombat ransomware. The BAT loader script executes the dropped payload on the victim's computer and then eliminates all traces of the downloaded and dropped malicious files, leaving no evidence of the infection.

The primary method of infection for this attack is through a phishing email, where the perpetrators pretend to be CoinPayments, a legitimate cryptocurrency payment gateway. They use a spoofed email address, "noreply at CoinPayments dot net," and the subject of the email is "[CoinPayments dot net] Payment Timed Out." The email also includes a malicious ZIP file attachment with a filename similar to a transaction ID referenced in the email's content, leading the recipient to believe it's genuine. The attachment contains a harmful BAT loader, which is activated when the user unzips the file to view its contents.

How Can You Protect Your System from Ransomware Attacks?

Ransomware attacks can be devastating, resulting in the loss of sensitive data and a significant financial cost. To protect your system from ransomware attacks, you can follow these steps:

• Backup your data: Regularly back up your data to an offline device, such as an external hard drive, and test the backup to ensure it works correctly.
• Keep your software updated: Install security updates and patches for your operating system and software applications as soon as they become available.
• Use antivirus software: Install and regularly update antivirus software to detect and remove any malware that may be present on your system.
• Be cautious when opening email attachments: Do not open email attachments from unknown senders or those that you were not expecting.
• Use strong passwords: Use unique, strong passwords for all accounts and change them regularly.
• Enable two-factor authentication: Enable two-factor authentication on all accounts that offer it for an additional layer of security.
• Be cautious of suspicious links: Do not click on links from untrusted sources, especially those sent in emails or text messages.