A financially motivated Russian threat actor, known as UAT-11795, is leveraging trojanized software to steal credentials and cryptocurrency, deploying a new backdoor named Starland RAT.
These attacks have been active since at least June 2025, primarily targeting users in the United States, with additional victims identified in Germany, Romania, and Venezuela.
Researchers from Cisco Talos have reported that attackers distribute their payloads through infected installers of legitimate software, including MobaXterm, WebEx, Zoom, DBeaver, and FaceIT.
While the exact infection vector remains unconfirmed, researchers suspect that malicious files are distributed using a technique known as ClickFix.
In a detailed analysis published today, Cisco Talos states that the attack initiates with an HTA file designed to retrieve a trojanized NSIS installer containing a Python loader disguised as a text file (LICENSE.txt).
The loader modifies the Windows registry, ensuring persistence, and decrypts & loads the Starland Remote Access Trojan (RAT).
Upon activation, Starland verifies whether it is operating in a sandbox, creates scheduled tasks and startup items for persistence, and seeks to elevate its permissions.
The malware scans for the following types of sensitive data on compromised systems:
- Browser data and cryptocurrency wallet assets (covering over 40 desktop and browser extension wallets)
- System information such as HWID, RAM, CPU, OS details, device name, region, public IP, and installed antivirus software
- Active Directory data including domain structure, domain controllers, and user privileges
Starland RAT is also capable of:
– Capturing screenshots of the victim’s desktop
– Executing shell commands
– Injecting 32-bit or 64-bit shellcode
– Downloading additional payloads (EXE, MSI, DLL, ZIP)
During the observed attack, a 64-bit shellcode chain was used to deploy the information-stealing malware CastleStealer, while a 32-bit chain delivered the Remcos RAT.
CastleStealer targets a range of credentials, including those stored in browsers, cryptocurrency wallets, Discord and Telegram sessions, and Steam accounts.
Remcos RAT offers functionalities such as keylogging, webcam and screen captures, audio recording, clipboard monitoring, file management, and remote command execution.
.jpg)
Source: Cisco Talos
Cisco Talos emphasizes the importance of having a redundancy mechanism in the malware’s command and control (C2) communications to account for potential failures in hard-coded addresses, utilizing XOR-encrypted fallback domains to query the Polygon smart contract.
Talos also revealed that UAT-11795 employs an undocumented PowerShell C2 framework known as WLDR, which leverages encrypted (PBKDF2-SHA256) beacons for communication, functions entirely in memory, and associates payload delivery to each victim’s hardware identifier.
To safeguard against UAT-11795 attacks, organizations are encouraged to reference IoC (indicators of compromise) in Cisco Talos reports.
Users should refrain from executing unknown commands found online and exclusively download software from verified official vendor sources.
Security teams document only 54% of successful attacks, with warnings issued for just 14%. The remaining incidents go undetected in the system.
Picus’ whitepaper details how to test SIEM and EDR rules through breach and attack simulations to ensure threats are identified.
Source: www.bleepingcomputer.com