UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign

UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 (TL-2026-1413) is a high-severity malware campaign, first published 2026-07-16. It is attributed to UAT-11795 (Russia) with medium confidence, affects Microsoft Windows (all supported desktop versions), maps to 46 MITRE ATT&CK techniques (T1005, T1008, T1010), and is covered by 9 detection rules and 36 indicators of compromise.

Key facts for TL-2026-1413

Threat ID
TL-2026-1413
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution
UAT-11795
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
cryptocurrency, gaming, general-consumer, cross-sector-opportunistic
Target regions
united states of america, germany, romania, venezuela
Detection rules
9
Indicators of compromise
36

Malware and tooling in UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2

Malware and tooling: CastleStealer, Remcos, Starland RAT, WLDR, NSIS installer

Cisco Talos identified UAT-11795, a Russian-speaking financially motivated threat actor, deploying novel Python-based Starland RAT and PowerShell-based WLDR C2 implant alongside CastleStealer and Remcos RAT via trojanized software installers, targeting cryptocurrency and credentials across the US, Germany, Romania, and Venezuela.

How UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 works

UAT-11795 is a Russian-speaking, financially motivated threat actor tracked by Cisco Talos, active since at least June 2025, conducting an opportunistic, volume-driven distribution campaign targeting victims primarily in the United States, with secondary targeting in Germany, Romania, and Venezuela. The actor lures victims via ClickFix-style social engineering that delivers a weaponized HTA file executed through mshta.exe. The HTA drops a batch file that downloads a trojanized software installer masquerading as legitimate applications including MobaXterm, Cisco WebEx, Zoom, DBeaver Community Edition, and the FACEIT gaming client. The NSIS-packaged installer executes a Python loader disguised as a LICENSE.txt file, which XOR-decrypts (key 0xC6) and executes the novel Starland RAT entirely in memory.

Starland RAT is a Python-based remote access tool built with defense evasion, system reconnaissance, and browser/cryptocurrency-wallet theft capabilities. It performs sandbox detection by checking for blacklisted usernames (WDAGUtilityAccount) and hostnames (Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis), checks Zone.Identifier alternate data streams on downloaded files, and establishes persistence via a scheduled task named "PythonLauncher-{3 random chars}" (AtLogOn trigger, RunLevel Highest), a Startup-folder LNK shortcut pointing at pythonw.exe, and an HKCU Run-key registry entry ("MyApp"). It communicates over HTTP POST using XOR encryption (key "helo1") with Base64 encoding on a 50-60 second beacon interval, deriving a hardware ID (HWID) for tracking. Supported commands include shellexecute, x32/x64 shellcode injection, and file download/execute for EXE, MSI, DLL, and ZIP payloads. Notably, Starland RAT implements a fallback command-and-control mechanism using a Polygon blockchain smart contract (address 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba, function selector 0xc659f3b8) that stores an XOR-encrypted (key "$m7*rYpry3") fallback domain, retrieved via a JSON-RPC eth_call against the Polygon RPC endpoint polygon-rpc[.]com, providing resilience against primary-domain takedown.

Optionally, Starland RAT executes a curl command to download a staged PowerShell-based implant chain culminating in the WLDR C2 Agent. The WLDR chain consists of a Stager, a Downloader, and an Agent, all executed in memory via PowerShell. WLDR communicates over HTTPS with Chrome v124 User-Agent header spoofing, uses AES-256-CBC encryption authenticated with HMAC-SHA256, and derives session keys via PBKDF2-SHA256 with 5,000 iterations from the hardcoded key "odg5t8mvssvh". It polls its C2 every 10 seconds, supports encrypted beaconing and task queuing, and executes additional payloads concurrently via a PowerShell RunspacePool supporting up to 10 threads, with PowerShell background jobs as a fallback execution engine. The implant uses a hardcoded mutex ("f2j398fj239d8j23dkkskskkkkkkkkk") to prevent multiple concurrent instances. A Russian-language VBScript comment ("Добавление команды в автозапуск для текущего пользователя" — "Adding command to autostart for current user") embedded in loader components supports the actor's Russian-speaking attribution.

Alongside Starland RAT and WLDR, the campaign deploys CastleStealer, a .NET infostealer targeting credentials, cryptocurrency wallets (40+ desktop and browser-extension wallets enumerated), and Discord, Telegram, and Steam session data. CastleStealer extracts Chromium and Firefox browser data via direct SQLite database access, supports DPAPI and AES-GCM decryption for credential stores, excludes Russian-locale systems from targeting, and can be delivered as a secondary payload via process injection or PowerShell. The campaign additionally distributes Remcos RAT, a long-abused (since 2016) commercial remote access tool providing keylogging, screen and webcam capture, audio recording, file management, and clipboard monitoring over an encrypted C2 channel.

The actor operates a Telegram-based notification and exfiltration channel: bot 8384531459 ("skuefq_bot") and bot 7993597060 ("komandastuk_bot") post to a private channel named "stuk komanda" (created June 5, 2025), receiving victim fingerprint and cryptocurrency-wallet-inventory data as part of execution confirmation. IP geolocation lookups are performed against api64.ipify[.]org during victim fingerprinting. Staging and C2 infrastructure includes eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io, windowscreenrepairnearme[.]com, and aipythondevs[.]com. Cisco Talos has published ClamAV, Snort, and network/DNS/malware detection coverage for the campaign.

MITRE ATT&CK techniques used in TL-2026-1413

Collection

T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1119 Automated Collection; T1123 Audio Capture; T1125 Video Capture

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography

Discovery

T1010 Application Window Discovery; T1033 System Owner/User Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.001 Local Account; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1027.005 Indicator Removal from Tools; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1497.001 System Checks; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task

Credential Access

T1056.001 Keylogging; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1059.006 Python; T1129 Shared Modules; T1204 User Execution

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

stealth

T1218.005 Mshta

privilege-escalation

T1548.002 Bypass User Account Control

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall

Affected products and versions in UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2

  • Microsoft — Windows (all supported desktop versions)
    Vulnerable versions: all currently supported Windows desktop releases

Remediation for UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2

Immediate actions

  • Block C2 and staging domains at DNS/proxy: eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io, windowscreenrepairnearme[.]com, aipythondevs[.]com
  • Deploy the published ClamAV, Snort (SIDs 66787-66790, 301580), and Talos Network/DNS/Malware Protection signatures
  • Block/alert on mshta.exe spawning downloads of remote HTA content (ClickFix pattern)
  • Hunt for scheduled tasks named 'PythonLauncher-*' with AtLogOn trigger and RunLevel Highest
  • Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries named 'MyApp'
  • Alert on outbound JSON-RPC eth_call traffic to polygon-rpc[.]com from endpoints, an unusual pattern for non-crypto workstations

Workarounds

  • Restrict or monitor mshta.exe execution via application control policy
  • Disable or restrict PowerShell execution of unsigned/remote scripts where not operationally required

Longer-term hardening

  • Deploy EDR/behavioral detection for in-memory Python and PowerShell execution chains (fileless RunspacePool activity)
  • Enforce application allowlisting to block execution of unsigned NSIS installers for common IT/gaming tools from non-vendor sources
  • User awareness training on ClickFix-style social engineering lures
  • Monitor for cryptocurrency wallet file access patterns consistent with wallet-stealer enumeration

Timeline of UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2

  • UAT-11795 campaign activity begins, per Cisco Talos, distributing trojanized installers for MobaXterm, WebEx, Zoom, DBeaver, and FACEIT
  • Telegram private channel "stuk komanda" created, used for C2 notification and victim data exfiltration
  • Talos publishes 13 named ClamAV signatures (Txt.Downloader.Agent-10060312-0 through Win.Malware.Remka-10060344) alongside Snort SIDs 66787-66790 and 301580 for network/DNS/malware protection coverage
  • Talos details WLDR PowerShell agent internals: AES-256-CBC + HMAC-SHA256 encryption with PBKDF2-SHA256 (5,000 iterations) session keys, 10-second C2 polling, RunspacePool concurrent task execution (up to 10 threads), Chrome v124 User-Agent spoofing over HTTPS
  • Talos documents full six-stage infection chain: ClickFix HTA lure via mshta.exe -> batch dropper with Telegram notification -> NSIS installer with disguised LICENSE.txt Python loader -> in-memory Starland RAT execution -> persistence/recon/C2 registration -> optional curl-delivered WLDR PowerShell stager/downloader/agent chain
  • Victimology confirmed across United States (primary), Germany, Romania, and Venezuela via opportunistic volume-driven distribution
  • Talos attributes campaign to Russian-speaking, financially motivated actor based on embedded Russian-language developer comments and CastleStealer's Russian-locale exclusion logic
  • Cisco Talos releases ClamAV signatures, Snort SIDs 66787-66790 and 301580, and Network/DNS/Malware Protection coverage
  • Cisco Talos publishes detailed analysis of UAT-11795, novel Starland RAT, and bespoke WLDR C2 implant

Sources cited for UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2

Threats related to UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2

Detection coverage for TL-2026-1413

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1413 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1413

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats