Forest Global Training Partners

Cyber Risks · Cisco Talos

New Mortal Kombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign

Summary: Cisco Talos detailed a financially motivated campaign that begins with a phishing email impersonating CoinPayments, using the spoofed sender "noreply[at]CoinPayments[.]net" and the subject "[CoinPayments[.]net] Payment Timed Out," with an attached ZIP containing a BAT loader. The loader uses bitsadmin to fetch a second ZIP, drops a "<filename>.PDF.EXE" payload that is either MortalKombat ransomware or the GO variant of Laplas Clipper, then deletes the downloaded and dropped files to remove infection markers.

Key Takeaway: Laplas Clipper sells for as little as $49 per week and rewrites crypto wallet addresses in the clipboard with lookalikes, while MortalKombat appends a ransom extension telling victims they have 24 hours before the price triples and directs them to a qTOX ID for payment talks. One of the two download servers, 193[.]169[.]255[.]78 in Poland, is running an RDP crawler scanning the internet for exposed port 3389.

Read the original at Cisco Talos ↗

Topics
Malware
Related