Ankura CTIX FLASH Update - November 8, 2022

Ransomware/Malware Activity

Emerging Clipper Malware "Laplas" Targeting Cryptocurrency Users

An emerging clipper malware dubbed "Laplas" has been targeting cryptocurrency users via the "SmokeLoader" malware. Cyble researchers observed this activity and detailed that SmokeLoader, which is delivered through malicious documents in spear-phishing campaigns, also acts as a carrier for various other malware including SystemBC and Raccoon Stealer 2.0. The Laplas malware is known for hijacking a cryptocurrency transaction by swapping the victim's wallet address with the operator's. This is conducted by monitoring the victim device's clipboard and verifying if any copied data contains a cryptocurrency wallet address. Laplas generates a wallet address that is similar to the victim's so that there is a smaller chance of the victim recognizing the attack. Laslas is advertised in cyber forums with feature details as well as prices for use. The clipper malware can support