Romanian cybersecurity firm Bitdefender has launched a free decryptor for a brand new ransomware pressure generally known as MortalKombat.
MortalKombat is a brand new ransomware pressure that emerged in January 2023. It is primarily based on commodity ransomware dubbed Xorist and has been noticed in assaults focusing on entities within the U.S., the Philippines, the U.Okay., and Turkey.
Xorist, detected since 2010, is distributed as a ransomware builder, permitting cyber menace actors to create and customise their very own model of the malware.
This contains the ransom observe, the file title of the ransom observe, the listing of file extensions focused, the wallpaper for use, and the extension for use on encrypted information.
MortalKombat notably was deployed in current assaults mounted by an unnamed financially motivated menace actor as part of a phishing marketing campaign aimed toward a variety of organizations.
“MortalKombat encrypts numerous information on the sufferer machine’s filesystem, equivalent to system, utility, database, backup, and digital machine information, in addition to information on the distant areas mapped as logical drives within the sufferer’s machine,” Cisco Talos disclosed earlier this month.
Though the ransomware doesn’t exhibit wiper conduct or delete quantity shadow copies, it corrupts Home windows Explorer, disables the Run command window, and removes all purposes and folders from Home windows startup.
It is also identified to deprave the deleted information within the Recycle Bin folder and alter the file names and kinds and make Home windows Registry modifications to realize persistence. The menace actors behind the marketing campaign and their operational mannequin are unknown as but.
“Primarily based on the Xorist ransomware, MortalKombat spreads by way of phishing emails and targets uncovered RDP cases,” Bitdefender mentioned. “The malware will get planted by way of the BAT Loader that additionally delivers the Laplas Clipper malware.”
MortalKombat shouldn’t be the one Xorist variant to have emerged within the menace panorama over the previous few months. In November 2022, Fortinet FortiGuard Labs revealed one other model that leaves a ransom observe in Spanish.
The event additionally comes a bit over a month after Avast printed a free decryptor for BianLian ransomware to assist victims of the malware recuperate locked information with out having to pay the menace actors.
