Ankura CTIX FLASH Update - February 17, 2023

Malware Activity

MortalKombat Ransomware and Laplas Clipper Malware Observed in New Campaign

A new financially motivated campaign that deploys the emerging "MortalKombat" ransomware and a Golang variant of the "Laplas" clipper malware has been identified. This campaign, which was first discovered in December 2022, has been observed targeting individuals as well as small and large organizations across primarily the United States, along with the United Kingdom, Turkey, and the Philippines. Researchers also noted that the currently unidentified actor responsible for the campaign has been observed "scanning the internet for victim machines with an exposed remote desktop protocol (RDP) port 3389" through an RDP crawler on a downloaded server. The attack chain begins with a phishing email that contains a malicious ZIP file and a cryptocurrency-themed lure impersonating a popular cryptocurrency payment gateway. The ZIP contains a BAT loader script that downloads an