New ransomware targets systems in the U.S.

[vtqhtr413]

Content source

https://www.bleepingcomputer.com/news/security/new-mortalkombat-ransomware-targets-systems-in-the-us/

Hackers conducting a new financially motivated campaign are using a variant of the Xortist commodity ransomware named 'MortalKombat,' together with the Laplas clipper in cyberattacks. Both malware infections are used to conduct financial fraud, with the ransomware used to extort victims to receive a decryptor and Laplas to steal cryptocurrency by hijacking crypto transactions. Laplas is a cryptocurrency hijacker released last year that monitors the Windows clipboard for crypto addresses and, when found, substitutes them for addresses under the attacker's control. As for MortalKombat, Cisco Talos says the new ransomware is based on the Xorist commodity ransomware family, which utilizes a builder that lets threat actors customize the malware. Xorist has been decryptable for free since 2016.

New ‘MortalKombat’ ransomware targets systems in the U.S.

Hackers conducting a new financially motivated campaign are using a variant of the Xorist commodity ransomware named 'MortalKombat,' together with the Laplas clipper in cyberattacks.

www.bleepingcomputer.com

 

[Zero Knowledge]

*Mortaaaaaaalllllllllllllll Kombaaaaaaaaaaaaaaaat* FIGHT!

 

[upnorth]

Spoiler: :P

 

[ForgottenSeer 98186]

Microsoft native security.

How easy was that?

 

[cruelsister]

Although the ransomware portion is rather a yawner, the extension of encrypted files was different:
photo.JPG..Remember_you_got_only_24_hours_to_make_the_payment_if_you_dont_pay_prize_will_triple_Mortal_Kombat_Ransomware

 

[Andy Ful]

Almost all ransomware attacks can be easily prevented (especially at home) by standard AV + shortcut/script restrictions and MS Office hardening. The real problem can be when people intentionally download pirated content or try to find something fortunate/rare/uncommon on the Internet. In the first case, one can expect that the protection will complain so it is possible that the protection will be intentionally decreased/ignored. In the second case, one can be a victim of fake web pages with malicious content - the fake web pages will be high on Google search results.
In both cases, the attack can work because the victim believes that the detection/block is most probably a false positive.

Of course, there are some other possibilities for infections (malvertising, phishing, etc.), but the chances are relatively much lower, especially when users do not decrease the protection.