WaterPlum DPRK Campaign: 30,000 Devices Infected, $10.7M in Crypto Stolen — Detection and Remediation Guide

---
title: Cryptocurrency Wallet File Access by Non-Wallet Process
id: 3b8f2c1a-7e4d-4a9f-b1c3-8d2e6f5a0b19
status: experimental
description: Detects processes outside known wallet/browser binaries accessing cryptocurrency wallet files and browser extension storage, consistent with WaterPlum-style wallet theft (DPRK financially motivated campaigns, MITRE T1555.003/T1552.001).
references:
  - https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Roaming\Bitcoin\wallet.dat'
      - '\AppData\Roaming\Ethereum\keystore\'
      - '\AppData\Roaming\Electrum\wallets\'
      - '\AppData\Roaming\Exodus\'
      - '\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_paths and not 1 of filter_browsers
falsepositives:
  - Legitimate backup software archiving user profiles
  - EDR/forensic tooling
level: high
---
title: Process Reading Clipboard at High Frequency (Address Swapper Behavior)
id: 91c4e2d7-5f3a-4b8e-a2d6-1c9f7b3e5a84
status: experimental
description: Detects non-system processes making repeated OpenClipboard/GetClipboardData calls, a hallmark of clipboard-hijacking stealers that swap cryptocurrency addresses at paste time (MITRE T1115). Deploy where your telemetry exposes clipboard API usage or via ETW-based sensors.
references:
  - https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
  - https://attack.mitre.org/techniques/T1115/
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.collection
  - attack.t1115
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\node.exe'
      - '\python.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - 'OpenClipboard'
      - 'GetClipboardData'
      - 'SetClipboardData'
      - 'System.Windows.Forms.Clipboard'
      - 'Get-Clipboard'
      - 'Set-Clipboard'
falsepositives:
  - Legitimate clipboard-management utilities
  - RMM tooling with clipboard sync features
level: medium
---
title: Persistence via Run Key by Unsigned Process in User Temp Path
id: 5d7a3f1c-2e8b-4c6d-9a1f-4b7e2c8d5a63
status: experimental
description: Detects registry Run-key persistence values pointing to executables in user-writable temp/roaming locations, a common WaterPlum-style stealer persistence pattern (MITRE T1060/T1547.001).
references:
  - https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
  selection_value:
    Details|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\Microsoft\'
  condition: selection_key and selection_value
falsepositives:
  - Legitimate user-installed updaters (OneDrive, Slack, Teams) — allowlist known-good values
level: high

let Lookback = 90d;
let WalletPaths = dynamic([
  @"\AppData\Roaming\Bitcoin\",
  @"\AppData\Roaming\Ethereum\keystore\",
  @"\AppData\Roaming\Electrum\",
  @"\AppData\Roaming\Exodus\",
  @"Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn",  // MetaMask
  @"Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm"   // MetaMask (Edge ID)
]);
let BrowserProcs = dynamic([@"chrome.exe", @"msedge.exe", @"firefox.exe", @"brave.exe", @"opera.exe"]);
let WalletAccess =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_any (WalletPaths)
    | where not(FileName has_any (BrowserProcs) or InitiatingProcessFileName has_any (BrowserProcs))
    | project WalletAccessTime=TimeGenerated, DeviceName, DeviceId, AccessingProcess=InitiatingProcessFileName,
              AccessingCmd=InitiatingProcessCommandLine, AccessingPath=InitiatingProcessFolderPath, TargetFile=FolderPath;
let ClipboardOrStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("Get-Clipboard","Set-Clipboard","OpenClipboard","IEX (","Invoke-WebRequest","curl ","wget ")
    | where ProcessCommandLine has_any ("-enc","-e ","FromBase64String","http")
    | project ProcTime=TimeGenerated, DeviceName, DeviceId, ProcName=FileName, ProcCmd=ProcessCommandLine;
WalletAccess
| join kind=leftouter ClipboardOrStaging on DeviceName, $left.WalletAccessTime between ($right.ProcTime .. ($right.ProcTime + 2h))
| extend NetworkEgress = toscalar(
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where DeviceName == tostring(WalletAccess.DeviceName) and InitiatingProcessFileName == tostring(WalletAccess.AccessingProcess)
    | where TimeGenerated between (WalletAccess.WalletAccessTime .. (WalletAccess.WalletAccessTime + 6h))
    | summarize make_set(RemoteUrl, 25))
| project WalletAccessTime, DeviceName, AccessingProcess, AccessingPath, TargetFile, ProcCmd, NetworkEgress
| order by WalletAccessTime desc

-- WaterPlum wallet-theft hunt: Run-key persistence in user-writable paths
-- plus processes with handles/cmdlines referencing wallet artifacts
LET persistence =
  SELECT Key.FullPath AS RegKey,
         Value.Name AS ValueName,
         Value.String AS ValueData
  FROM glob(globs=[
    'HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*',
    'HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*'
  ], accessor='registry')
  WHERE ValueData =~ '(?i)(appdata\\\\(local\\\\temp|roaming)|users\\\\public|programdata)'

LET wallet_procs =
  SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE CommandLine =~ '(?i)(wallet\\.dat|keystore|electrum|exodus|nkbihfbeogaeaoehlefnkodbefgpgknn|get-clipboard|openclipboard)'
     OR Exe =~ '(?i)(appdata\\\\local\\\\temp|users\\\\public)'

SELECT * FROM persistence
UNION ALL
SELECT NULL AS RegKey, Name AS ValueName, CommandLine AS ValueData FROM wallet_procs

# WaterPlum Post-Compromise Verification & Hardening Script
# Run elevated. Review output before acting on flagged items.

Write-Host "=== [1] Suspicious Run-Key Persistence ===" -ForegroundColor Cyan
$runKeys = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
      $val = (Get-ItemProperty $key).$($_.Name)
      if ($val -match 'AppData\\Local\\Temp|Users\\Public|AppData\\Roaming') {
        Write-Host "[FLAG] $key :: $($_.Name) = $val" -ForegroundColor Red
      }
    }
  }
}

Write-Host "=== [2] Wallet Artifacts Present (scoping) ===" -ForegroundColor Cyan
$walletPaths = @(
  "$env:APPDATA\Bitcoin\wallet.dat",
  "$env:APPDATA\Ethereum\keystore",
  "$env:APPDATA\Electrum\wallets",
  "$env:APPDATA\Exodus",
  "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn"
)
foreach ($p in $walletPaths) {
  if (Test-Path $p) { Write-Host "[FOUND] $p (last write: $((Get-Item $p).LastWriteTime))" -ForegroundColor Yellow }
}

Write-Host "=== [3] Unsigned Executables in Temp/Roaming ===" -ForegroundColor Cyan
Get-ChildItem "$env:TEMP","$env:APPDATA" -Recurse -Include *.exe,*.dll,*.msi -ErrorAction SilentlyContinue |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') { Write-Host "[FLAG] $($_.FullName) - $($sig.Status)" -ForegroundColor Red }
  }

Write-Host "=== [4] Scheduled Tasks Launching from User Paths ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'AppData|Temp|Users\\Public'
} | ForEach-Object { Write-Host "[FLAG] $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" -ForegroundColor Red }

Write-Host "=== [5] Hardening: Enable ASR rules blocking credential theft (requires Defender) ===" -ForegroundColor Cyan
# Block credential stealing from LSASS + executable content from email/archive
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  '9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2','be9ba2d9-53ea-4cdc-84e5-9b1eeee46550' `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled

Write-Host "=== [6] Egress check: recent connections to non-RFC1918 from script hosts ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)' } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.ProcessName -match 'powershell|pwsh|node|python|wscript|cscript') {
      Write-Host "[FLAG] $($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Red
    }
  }

Write-Host "=== Review all [FLAG] entries with IR before removal. Preserve evidence. ===" -ForegroundColor Green