A new financially motivated campaign that deploys the emerging “MortalKombat” ransomware and a Golang variant of the “Laplas” clipper malware has been identified. This campaign, which was first discovered in December 2022, has been observed targeting individuals as well as small and large organizations across primarily the United States, along with the United Kingdom, Turkey, and the Philippines. Researchers also noted that the currently unidentified actor responsible for the campaign has been observed “scanning the internet for victim machines with an exposed remote desktop protocol (RDP) port 3389” through an RDP crawler on a downloaded server. The attack chain begins with a phishing email that contains a malicious ZIP file and a cryptocurrency-themed lure impersonating a popular cryptocurrency payment gateway. The ZIP contains a BAT loader script that downloads an additional ZIP file from a controlled hosting server and executes the payload, which is either ransomware or the clipper malware. All evidence of the malicious files is then deleted. MortalKombat was first discovered in January 2023 and has been observed encrypting files on victim machines’ filesystems (such as system, application, database, virtual machine files, and backup) as well as on remote locations mapped as logical drives. It is emphasized that there was no indication of wiper behavior or the deletion of large volume shadow copies in the observed instances. The researchers determined, through source code analysis, that MortalKombat has similarities to the Xorist ransomware family. Xorist first appeared in 2010 and has evolved by creating several variants through the use of ransomware builders. Laplas, which was first identified in November 2022, is a stealer malware that targets cryptocurrency users by “employing regular expressions to monitor the victim machine’s clipboard for their cryptocurrency wallet address.” A look-alike wallet address is created, and the victim’s address is then overwritten. CTIX analysts urge users to stay vigilant when conducting cryptocurrency transactions and ensure their systems remain up to date with the latest security updates. A technical analysis as well as indicators of compromise (IOCs) can be viewed in the articles linked below.