# UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign

> Cisco Talos identified UAT-11795, a Russian-speaking financially motivated threat actor, deploying novel Python-based Starland RAT and PowerShell-based WLDR C2 implant alongside CastleStealer and Remcos RAT via trojanized software installers, targeting cryptocurrency and credentials across the US, Germany, Romania, and Venezuela.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1413
- **ID:** TL-2026-1413
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAT-11795 (Russia)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

UAT-11795 is a Russian-speaking, financially motivated threat actor tracked by Cisco Talos, active since at least June 2025, conducting an opportunistic, volume-driven distribution campaign targeting victims primarily in the United States, with secondary targeting in Germany, Romania, and Venezuela. The actor lures victims via ClickFix-style social engineering that delivers a weaponized HTA file executed through mshta.exe. The HTA drops a batch file that downloads a trojanized software installer masquerading as legitimate applications including MobaXterm, Cisco WebEx, Zoom, DBeaver Community Edition, and the FACEIT gaming client. The NSIS-packaged installer executes a Python loader disguised as a LICENSE.txt file, which XOR-decrypts (key 0xC6) and executes the novel Starland RAT entirely in memory.

Starland RAT is a Python-based remote access tool built with defense evasion, system reconnaissance, and browser/cryptocurrency-wallet theft capabilities. It performs sandbox detection by checking for blacklisted usernames (WDAGUtilityAccount) and hostnames (Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis), checks Zone.Identifier alternate data streams on downloaded files, and establishes persistence via a scheduled task named "PythonLauncher-{3 random chars}" (AtLogOn trigger, RunLevel Highest), a Startup-folder LNK shortcut pointing at pythonw.exe, and an HKCU Run-key registry entry ("MyApp"). It communicates over HTTP POST using XOR encryption (key "helo1") with Base64 encoding on a 50-60 second beacon interval, deriving a hardware ID (HWID) for tracking. Supported commands include shellexecute, x32/x64 shellcode injection, and file download/execute for EXE, MSI, DLL, and ZIP payloads. Notably, Starland RAT implements a fallback command-and-control mechanism using a Polygon blockchain smart contract (address 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba, function selector 0xc659f3b8) that stores an XOR-encrypted (key "$m7*rYpry3") fallback domain, retrieved via a JSON-RPC eth_call against the Polygon RPC endpoint polygon-rpc[.]com, providing resilience against primary-domain takedown.

Optionally, Starland RAT executes a curl command to download a staged PowerShell-based implant chain culminating in the WLDR C2 Agent. The WLDR chain consists of a Stager, a Downloader, and an Agent, all executed in memory via PowerShell. WLDR communicates over HTTPS with Chrome v124 User-Agent header spoofing, uses AES-256-CBC encryption authenticated with HMAC-SHA256, and derives session keys via PBKDF2-SHA256 with 5,000 iterations from the hardcoded key "odg5t8mvssvh". It polls its C2 every 10 seconds, supports encrypted beaconing and task queuing, and executes additional payloads concurrently via a PowerShell RunspacePool supporting up to 10 threads, with PowerShell background jobs as a fallback execution engine. The implant uses a hardcoded mutex ("f2j398fj239d8j23dkkskskkkkkkkkk") to prevent multiple concurrent instances. A Russian-language VBScript comment ("Добавление команды в автозапуск для текущего пользователя" — "Adding command to autostart for current user") embedded in loader components supports the actor's Russian-speaking attribution.

Alongside Starland RAT and WLDR, the campaign deploys CastleStealer, a .NET infostealer targeting credentials, cryptocurrency wallets (40+ desktop and browser-extension wallets enumerated), and Discord, Telegram, and Steam session data. CastleStealer extracts Chromium and Firefox browser data via direct SQLite database access, supports DPAPI and AES-GCM decryption for credential stores, excludes Russian-locale systems from targeting, and can be delivered as a secondary payload via process injection or PowerShell. The campaign additionally distributes Remcos RAT, a long-abused (since 2016) commercial remote access tool providing keylogging, screen and webcam capture, audio recording, file management, and clipboard monitoring over an encrypted C2 channel.

The actor operates a Telegram-based notification and exfiltration channel: bot 8384531459 ("skuefq_bot") and bot 7993597060 ("komandastuk_bot") post to a private channel named "stuk komanda" (created June 5, 2025), receiving victim fingerprint and cryptocurrency-wallet-inventory data as part of execution confirmation. IP geolocation lookups are performed against api64.ipify[.]org during victim fingerprinting. Staging and C2 infrastructure includes eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, zynaris[.]io, windowscreenrepairnearme[.]com, and aipythondevs[.]com. Cisco Talos has published ClamAV, Snort, and network/DNS/malware detection coverage for the campaign.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1059.001 PowerShell
- T1059.006 Python
- T1059.005 Visual Basic
- T1218.005 Mshta
- T1204 User Execution
- T1129 Shared Modules
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.005 Indicator Removal from Tools
- T1497.001 System Checks
- T1055 Process Injection
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1548.002 Bypass User Account Control
- T1686 Disable or Modify System Firewall
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1087.001 Local Account
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1482 Domain Trust Discovery
- T1033 System Owner/User Discovery
- T1069.002 Domain Groups
- T1005 Data from Local System
- T1113 Screen Capture
- T1119 Automated Collection
- T1123 Audio Capture
- T1115 Clipboard Data
- T1125 Video Capture
- T1071.001 Web Protocols
- T1008 Fallback Channels
- T1573.001 Symmetric Cryptography

## Sources

- [UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign](https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/)
- [Cisco Talos Intelligence Group](https://www.talosintelligence.com/)
- [Cisco Talos Blog - Malware category](https://blog.talosintelligence.com/category/malware/)
- [Cisco Talos Blog - RAT category](https://blog.talosintelligence.com/category/rat/)
- [Cisco Talos Blog - APT category](https://blog.talosintelligence.com/category/apt/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1413