Blog
/
Network
/
March 14, 2023

Protecting Yourself from Laplas Clipper Crypto Theives

Explore strategies to combat Laplas Clipper attacks and enhance your defenses against cryptocurrency theft in the digital landscape.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Anna Gilbertson
Cyber Security Analyst
Written by
Hanah Darley
Director of Threat Research
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
14
Mar 2023

Between June 2021 and June 2022, crypto-currency platforms around the world lost an estimated 44 billion USD to cyber criminals, whose modus operandi range from stealing passwords and account recovery phrases, to cryptojacking and directly targeting crypto-currency transactions. 

There has been a recent rise in cases of cyber criminals’ using information stealer malware to gather and exfiltrate sensitive crypto-currency wallet details, ultimately leading to the theft of significant sums of digital currency. Having an autonomous decision maker able to detect and respond to potential compromises is crucial to safeguard crypto wallets and transactions against would-be attackers.

In late 2022, Darktrace observed several threat actors employing a novel attack method to target crypto-currency users across its customer base, specifically the latest version of the Laplas Clipper malware. Using Self-Learning AI, Darktrace DETECT/Network™ and Darktrace RESPOND/Network™ were able to uncover and mitigate Laplas Clipper activity and intervene to prevent the theft of large sums of digital currency.

Laplas Clipper Background

Laplas Clipper is a variant of information stealing malware which operates by diverting crypto-currency transactions from victims’ crypto wallets into the wallets of threat actors [1]. Laplas Clipper is a Malware-as-a-Service (MaaS) offering available for purchase and use by a variety of threat actors. It has been observed in the wild since October 2022, when 180 samples were identified and linked with another malware strain, namely SmokeLoader [2]. This loader has itself been observed since at least 2011 and acts as a delivery mechanism for popular malware strains [3]. 

SmokeLoader is typically distributed via malicious attachments sent in spam emails or targeted phishing campaigns but can also be downloaded directly by users from file hosting pages or spoofed websites. SmokeLoader is known to specifically deliver Laplas Clipper onto compromised devices via a BatLoader script downloaded as a Microsoft Word document or a PDF file attached to a phishing email. These examples of social engineering are relatively low effort methods intended to convince users to download the malware, which subsequently injects malicious code into the explorer.exe process and downloads Laplas Clipper.

Laplas Clipper activity observed across Darktrace’s customer base generally began with SmokeLoader making HTTP GET requests to Laplas Clipper command and control (C2) infrastructure. Once downloaded, the clipper loads a ‘build[.]exe’ module and begins monitoring the victim’s clipboard for crypto-currency wallet addresses. If a wallet address is identified, the infected device connects to a server associated with Laplas Clipper and downloads wallet addresses belonging to the threat actor. The actor’s addresses are typically spoofed to appear similar to those they replace in order to evade detection. The malware continues to update clipboard activity and replaces the user’s wallet addresses with a spoofed address each time one is copied for a for crypto-currency transactions.

Darktrace Coverage of Laplas Clipper and its Delivery Methods 

In October and November 2022, Darktrace observed a significant increase in suspicious activity associated with Laplas Clipper across several customer networks. The activity consisted largely of:  

  1. User devices connecting to a suspicious endpoint.  
  2. User devices making HTTP GET requests to an endpoint associated with the SmokeLoader loader malware, which was installed on the user’s device.
  3. User devices making HTTP connections to the Laplas Clipper download server “clipper[.]guru”, from which it downloads spoofed wallet addresses to divert crypto-currency payments. 

In one particular instance, a compromised device was observed connecting to endpoints associated with SmokeLoader shortly before connecting to a Laplas Clipper download server. In other instances, devices were detected connecting to other anomalous endpoints including the domains shonalanital[.]com, transfer[.]sh, and pc-world[.]uk, which appears to be mimicking the legitimate endpoint thepcworld[.]com. 

Additionally, some compromised devices were observed attempting to connect malicious IP addresses including 193.169.255[.]78 and 185.215.113[.]23, which are associated with the RedLine stealer malware. Additionally, Darktrace observed connections to the IP addresses 195.178.120[.]154 and 195.178.120[.]154, which are associated with SmokeLoader, and 5.61.62[.]241, which open-source intelligence has associated with Cobalt Strike. 

Figure 1: Beacon to Young Endpoint model breach demonstrating Darktrace’s ability to detect external connections that are considered extremely rare for the network.
Figure 2: The event log of an infected device attempting to connect to IP addresses associated with the RedLine stealer malware, and the actions RESPOND took to block these attempts.

The following DETECT/Network models breached in response to these connections:

  • Compromise / Beacon to Young Endpoint 
  • Compromise / Slow Beaconing Activity to External Rare 
  • Compromise / Beacon for 4 Days
  • Compromise / Beaconing Activity to External Rare
  • Compromise / Sustained TCP Beaconing Activity to Rare Endpoint 
  • Anomalous Connection / Multiple Failed Connections to Rare Endpoints 
  • Compromise / Large Number of Suspicious Failed Connections 
  • Compromise / HTTP Beaconing to Rare Destination 
  • Compromise / Post and Beacon to Rare External 
  • Anomalous Connection / Callback on Web Facing Device 

DETECT/Network is able to identify such activity as its models operate based on a device’s usual pattern of behavior, rather than a static list of indicators of compromise (IOCs). As such, Darktrace can quickly identify compromised devices that deviate for their expected pattern of behavior by connecting to newly created malicious endpoints or C2 infrastructure, thereby triggering an alert.

In one example, RESPOND/Network autonomously intercepted a compromised device attempting to connect to the Laplas Clipper C2 server, preventing it from downloading SmokeLoader and subsequently, Laplas Clipper itself.

Figure 3: The event log of an infected device attempting to connect to the Laplas Clipper download server, and the actions RESPOND/Network took to block these attempts.

In another example, DETECT/Network observed an infected device attempting to perform numerous DNS Requests to a crypto-currency mining pool associated with the Monero digital currency.  

This activity caused the following DETECT/Network models to breach:

  • Compromise / Monero Mining
  • Compromise / High Priority Crypto Currency Mining 

RESPOND/Network quickly intervened, enforcing a previously established pattern of life on the device, ensuring it could not perform any unexpected activity, and blocking the connections to the endpoint in question for an hour. These actions carried out by Darktrace’s autonomous response technology prevented the infected device from carrying out crypto-mining activity, and ensured the threat actor could not perform any additional malicious activity.

Figure 4. The event log of an infected devices showing DNS requests to the Monero crypto-mining pool, and the actions taken to block them by RESPOND/Network.

Finally, in instances when RESPOND/Network was not activated, external connections to the Laplas Clipper C2 server were nevertheless monitored by DETECT/Network, and the customer’s security team were notified of the incident.

Conclusion 

The rise of information stealing malware variants such as Laplas Clipper highlights the importance of crypto-currency and crypto-mining in the malware ecosystem and more broadly as a significant cyber security concern. Crypto-mining is often discounted as background noise for security teams or compliance issues that can be left untriaged; however, malware strains like Laplas Clipper demonstrate the real security risks posed to digital estates from threat actors focused on crypto-currency. 

Leveraging its Self-Learning AI, DETECT/Network and RESPOND/Network are able to work in tandem to quickly identify connections to suspicious endpoints and block them before any malicious software can be downloaded, safeguarding customers.

Appendices

List of IOCs 

a720efe2b3ef7735efd77de698a5576b36068d07 - SHA1 Filehash - Laplas Malware Download

conhost.exe - URI - Laplas Malware Download

185.223.93.133 - IP Address - Laplas C2 Endpoint

185.223.93.251 - IP Address - Laplas C2 Endpoint

45.159.189.115 - IP Address - Laplas C2 Endpoint

79.137.204.208 - IP Address - Laplas C2 Endpoint

5.61.62.241 - IP Address - Laplas C2 Endpoint

clipper.guru - URI - Laplas C2 URI

/bot/online?guid= - URI - Laplas C2 URI

/bot/regex?key= - URI - Laplas C2 URI

/bot/get?address - URI - Laplas C2 URI

Mitre Attack and Mapping 

Initial Access:

T1189 – Drive By Compromise 

T1566/002 - Spearphishing

Resource Development:

T1588 / 001 - Malware

Ingress Tool Transfer:

T1105 – Ingress Tool Transfer

Command and Control:

T1071/001 – Web Protocols 

T1071 – Application Layer Protocol

T1008 – Fallback Channels

T1104 – Multi-Stage Channels

T1571 – Non-Standard Port

T1102/003 – One-Way Communication

T1573 – Encrypted Channel

Persistence:

T1176 – Browser Extensions

Collection:

T1185 – Man in the Browser

Exfiltration:

T1041 – Exfiltration over C2 Channel

References

[1] https://blog.cyble.com/2022/11/02/new-laplas-clipper-distributed-by-smokeloader/ 

[2] https://thehackernews.com/2022/11/new-laplas-clipper-malware-targeting.html

[3] https://attack.mitre.org/software/S0226/

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Anna Gilbertson
Cyber Security Analyst
Written by
Hanah Darley
Director of Threat Research

More in this series

No items found.

Blog

/

Email

/

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

Default blog imageDefault blog image

In today’s threat landscape, email remains the most targeted vector for cyberattacks. Organizations require not only multi-layered defenses but also advanced, integrated systems that work collaboratively to proactively mitigate threats before they cause damage

That’s why we’re proud to announce a new integration between Darktrace / EMAIL and Microsoft Defender for Office 365, delivering a Unified Quarantine experience that empowers security teams with seamless visibility, control, and response across both platforms.

This announcement builds on a strong and growing collaboration. In 2024, Darktrace was honored as Microsoft UK Partner of the Year and recognized as a Security Trailblazer at the annual Microsoft Security 20/20 Awards, a testament to our shared commitment to innovation and customer-centric security.

A Shared Mission: Stopping Threats at Machine Speed

This integration is more than a technical milestone,as it’s a reflection of a shared mission: to protect organizations from both known and unknown threats, with efficiency, accuracy, and transparency.

  • Microsoft Defender for Office 365 delivers a comprehensive security framework that safeguards Microsoft 365 email and collaboration workloads leveraging advanced AI, global threat intelligence and information on known attack infrastructure.
  • Darktrace / EMAIL complements this with Self-Learning AI that understands the unique communication patterns within each organization, detecting subtle anomalies that evade traditional detection methods.

Together, we’re delivering multi-layered, adaptive protection that’s greater than the sum of its parts.

“Our integration with Microsoft gives security teams the tools they need to act faster and more precisely to detect and respond to threats,” said Jill Popelka, CEO of Darktrace. “Together, we’re strengthening defenses where it matters most to our customers: at the inbox.”

Unified Quarantine: One View, Total Clarity

The new Unified Quarantine experience gives customers a single pane of glass to view and manage email threatsregardless of which product took action. This means:

  • Faster investigations with consolidated visibility
  • Clear attribution of actions and outcomes across both platforms
  • Streamlined workflows for security teams managing complex environments

“This integration is a testament to the power of combining Microsoft’s global threat intelligence with Darktrace’s unique ability to understand the ‘self’ of an organization,” said Jack Stockdale, CTO of Darktrace. “Together, we’re delivering a new standard in proactive, adaptive email security.”

A New Era of Collaborative Cyber Defense

This collaboration represents a broader shift in cybersecurity: from siloed tools to integrated ecosystems. As attackers become more sophisticated, defenders must move faster, smarter, and in unison.

Through this integration, Darktrace and Microsoft establish a new standard for collaboration between native and third-party security solutions, enhancing not only threat detection but also comprehensive understanding and proactive measures against threats.

We’re excited to bring this innovation to our customers and continue building a future where AI and human expertise collaborate to secure the enterprise.

[related-resource]

Continue reading
About the author
Carlos Gray
Senior Product Marketing Manager, Email

Blog

/

Network

/

June 18, 2025

Customer Case Study: Leading Petrochemical Manufacturer

Default blog imageDefault blog image

Headquartered in Saudi Arabia, this industry leading petrochemical manufacturer serves customers in more than 80 countries across diverse markets throughout Europe, Africa, Latin America, the Middle East, China, and Southeast Asia.

Cyber resiliency critical to growth strategy

This leading petrochemical manufacturer’s vision is to be one of the major global players in the production and marketing of designated petrochemicals and downstream products. The company aims to significantly increase its capacity to up to a million metric tons within the next few years.

With cyber-attacks on critical infrastructure increasing 30% globally last year, cyber resiliency is essential to supporting the company’s strategic business goals of:

  • Maximizing production through efficient asset utilization
  • Maximizing sales by conducting 90% of its business outside Saudi Arabia
  • Optimizing resources and processes by integrating with UN Global Compact principles for sustainability and efficiency
  • Growing its business portfolio by engaging in joint ventures to diversify production and add value to the economy

However, the industry leader faced several challenges in its drive to fortify its cybersecurity defenses.

Visibility gaps delay response time

The company’s existing security setup provided limited visibility to the in-house security team, hindering its ability to detect anomalous network and user activity in real time. This resulted in delayed responses to potential incidents, making proactive issue resolution difficult and any remediation in the event of a successful attack costly and time-consuming.

Manual detection drains resources

Without automated detection and response capabilities, the organization’s security team had to manually monitor for suspicious activity – a time-consuming and inefficient approach that strained resources and left the organization vulnerable. This made it difficult for the team to stay current with training or acquire new skills and certifications, which are core to the ethos of both the company’s owners and the team itself.

Cyber-attacks on critical infrastructure increasing

The petrochemical manufacturer is part of a broader ecosystem of companies, making the protection of its supply chain – both upstream and downstream – critical. With several manufacturing entities and multiple locations, the customer’s internal structure is complex and challenging to secure. As cyber-attacks on critical infrastructure escalate, it needed a more comprehensive approach to safeguard its business and the wider ecosystem.

Keeping and growing skills and focus in-house

To strengthen its cybersecurity strategy, the company considered two options:

  1. Make a significant initial and ongoing investment in a Security Operations Center (SOC), which would involve skills development outside the company and substantial management overhead.
  2. Use a combination of new, automated tools and an outsourced Managed Detection and Response (MDR) service to reduce the burden on internal security specialists and allow the company to invest in upskilling its staff so they can focus on more strategic tasks.

Faced with this choice between entirely outsourcing security and augmenting the security team with new capabilities, the customer chose the second option, selecting Darktrace to automate the company’s monitoring, detection, and response. Today, the petrochemical manufacturer is using:

Extending the SOC with 24/7 expert support

To alleviate the burden on its lean security team, the company augmented its in-house capabilities with Darktrace’s Managed Detection & Response service. This support acts as an extension of its SOC, providing 24/7 monitoring, investigation, and escalation of high-priority threats. With Darktrace’s global SOC managing alert triage and autonomously containing threats, the organization’s internal team can focus on strategic initiatives. The result is a stronger security posture and increased capacity to proactively address evolving cyber risks – without expanding headcount or sacrificing visibility.

A unique approach to AI

In its search for a new security platform, the company’s Director of Information Technology said Darktrace’s autonomous response capability, coupled with Self-Learning AI-driven threat reduction, were two big reasons for selecting Darktrace over competing products and services.

AI was a huge factor – no one else was doing what Darktrace was doing with [AI].”

Demonstrated visibility

Before Darktrace, the customer had no visibility into the network activity to and from remote worker devices. Some employees need the ability to connect to its networks at any time and from any location, including the Director of Information Technology. The trial deployment of Darktrace / ENDPOINT was a success and gave the team peace of mind that, no matter the location or device, high-value remote workers were protected by Darktrace.

Modular architecture  

Darktrace's modular architecture allowed the company to deploy security controls across its complex, multi-entity environment. The company’s different locations run on segregated networks but are still interconnected and need to be protected. Darktrace / NETWORK provides a unified view and coordinated security response across the organization’s entire network infrastructure, including endpoint devices.

Results

The petrochemical manufacturer is using Darktrace across all of its locations and has achieved total visibility across network and user activity. “Darktrace is increasing in value every day,” said the Director of Information Technology.

I don’t have a big team, and Darktrace makes our lives very, very easy, not least the automation of some of the tasks that require constant manual review.”

Time savings frees analysts to focus on proactive security

Darktrace / NETWORK provides continuous, AI-driven monitoring and analysis of the company’s network activity, user behavior, and threat patterns, establishing a baseline of what normal activity looks like, and then alerting analysts to any deviations from normal traffic, activity, and behaviors. Darktrace’s autonomous response capabilities speed up response to detected threats, meaning intervention from the security team is required for fewer incidents and alerts.

In October 2024 alone, Darktrace Cyber AI Analyst saved the team 810 investigation hours, and autonomously responded to 180 anomalous behaviors that were uncovered during the investigations. With Darktrace managing the majority of threat detection and response efforts, the security team has been able to change its day-to-day activity from manual review of traffic and alerts and belated response to activity, to proactively fortifying its detection and response posture and upskilling to meet evolving requirements.  

Layered email protection reduces phishing threats

The company’s email infrastructure posed a challenge due to petrochemical industry regulations requiring on-premises email servers, with some security delivered via Microsoft Azure. By integrating Darktrace / EMAIL into the Azure stack, the organization has reduced the volume of phishing emails its users receive by 5%.

“Now we have one more layer of security related to email – every email goes through two filters. If something is not being caught or traced by Azure, it is being detected by Darktrace,” said the Director of Information Technology. “As a result, we’re now seeing only about 15% to 20% of the phishing emails we used to receive before implementing Darktrace.”

Preparing for a secure future

The time saved using Darktrace has helped the security team take proactive steps, including preparing for new cyber resilience regulations for Saudi Arabia’s Critical National Infrastructure, as mandated by the National Cybersecurity Authority (NCA).

“The team now has ample time to prepare policies and procedures that meet the new NCA regulations and, in some cases, enhance the requirements of the new law,” said the Director of Information Technology. “All of this is possible because they don’t need to keep watch; Darktrace takes on so much of that task for them.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI