Bitdefender Releases Free Decryptor for MortalKombat Ransomware Strain

Feb 28, 2023Ravie LakshmananRansomware / Malware

Romanian cybersecurity firm Bitdefender has launched a free decryptor for a brand new ransomware pressure often known as MortalKombat.

MortalKombat is a brand new ransomware pressure that emerged in January 2023. It’s based mostly on commodity ransomware dubbed Xorist and has been noticed in assaults focusing on entities within the U.S., the Philippines, the U.Ok., and Turkey.

Xorist, detected since 2010, is distributed as a ransomware builder, permitting cyber risk actors to create and customise their very own model of the malware.

This contains the ransom notice, the file title of the ransom notice, the record of file extensions focused, the wallpaper for use, and the extension for use on encrypted information.

MortalKombat notably was deployed in current assaults mounted by an unnamed financially motivated risk actor as part of a phishing marketing campaign geared toward a variety of organizations.

“MortalKombat encrypts numerous information on the sufferer machine’s filesystem, comparable to system, software, database, backup, and digital machine information, in addition to information on the distant areas mapped as logical drives within the sufferer’s machine,” Cisco Talos disclosed earlier this month.

Although the ransomware doesn’t exhibit wiper habits or delete quantity shadow copies, it corrupts Windows Explorer, disables the Run command window, and removes all purposes and folders from Windows startup.

It’s additionally identified to deprave the deleted information within the Recycle Bin folder and alter the file names and kinds and make Windows Registry modifications to attain persistence. The risk actors behind the marketing campaign and their operational mannequin are unknown as but.

“Based on the Xorist ransomware, MortalKombat spreads by means of phishing emails and targets uncovered RDP situations,” Bitdefender stated. “The malware will get planted by means of the BAT Loader that additionally delivers the Laplas Clipper malware.”

MortalKombat is just not the one Xorist variant to have emerged within the risk panorama over the previous few months. In November 2022, Fortinet FortiGuard Labs revealed one other model that leaves a ransom notice in Spanish.

The growth additionally comes a bit over a month after Avast revealed a free decryptor for BianLian ransomware to assist victims of the malware get well locked information with out having to pay the risk actors.