Starland RAT Campaign (UAT-11795) — Trojanized WebEx, Zoom, MobaXterm, DBeaver & FACEIT Installers Deliver Python RAT and Novel WLDR PowerShell C2 Implant
Starland RAT Campaign (UAT-11795) (TL-2026-1454), also tracked as UAT-11795 Trojanized Software Campaign, is a high-severity malware campaign, first published 2026-07-17. It is attributed to UAT-11795 (Russia) with medium confidence, affects Cisco (WebEx) Webex installer (trojanized third-party redistribution), maps to 46 MITRE ATT&CK techniques (T1005, T1008, T1016), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1454
- Threat ID
- TL-2026-1454
- Also known as
- UAT-11795 Trojanized Software Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-17
- Last reviewed
- 2026-07-17
- Attribution
- UAT-11795
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- general enterprise, gaming, consumer end-user
- Target regions
- united states of america, germany, romania, venezuela
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Starland RAT Campaign (UAT-11795)
Malware and tooling: CastleStealer, Remcos, Starland RAT, WLDR
UAT-11795, a Russian-speaking financially-motivated threat actor active since at least June 2025, lures victims via ClickFix-style social engineering into running an HTA downloader that deploys trojanized NSIS installers for WebEx, Zoom, MobaXterm, DBeaver, and FACEIT. A bundled Python loader decrypts the novel Starland RAT, which harvests credentials and 40+ cryptocurrency wallet types, and can hand off to a bespoke in-memory PowerShell C2 framework (WLDR) or drop CastleStealer (x64) / a Remcos RAT variant (x32) via shellcode injection.
How Starland RAT Campaign (UAT-11795) works
UAT-11795 is a financially-motivated, Russian-speaking threat actor first observed by Cisco Talos operating since at least June 2025, targeting users primarily in the United States with secondary activity in Germany, Romania, and Venezuela. The actor's initial access relies on a ClickFix social-engineering technique that tricks victims into copy-pasting and executing a command that invokes mshta.exe to retrieve a weaponized HTA file. The HTA embeds VBScript (containing Russian-language developer comments) that drops a batch file to the user's temp folder and establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key.
The HTA stage then retrieves trojanized NSIS installers that repackage legitimate software — MobaXterm, WebEx, Zoom, DBeaverCE, and FACEIT — bundled with a malicious Python loader disguised as a LICENSE.txt text file. The loader is byte-compiled Python that XOR-decrypts (key 0xC6) and executes an embedded Python RAT in memory, dubbed Starland RAT by Talos. Starland RAT performs sandbox/analysis evasion (checking for WDAGUtilityAccount, Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis artifacts and hardcoded sandbox usernames), establishes persistence via randomized "PythonLauncher-*" scheduled tasks (AtLogOn trigger) and a Startup-folder LNK targeting pythonw.exe, and attempts UAC elevation via ShellExecuteW's "runas" verb.
Once active, Starland RAT enumerates the host (HWID derived from the C: volume serial, RAM, CPU, installed AV products), performs Active Directory reconnaissance (Get-CimInstance, nltest), captures in-memory Base64-encoded PNG screenshots, and scans for 40+ cryptocurrency wallet types alongside browser data. It beacons every 50-60 seconds over XOR-encrypted (key "helo1") Base64 JSON to hardcoded C2 domains windowscreenrepairnearme[.]com and aipythondevs[.]com, and separately reports victim fingerprints and wallet inventories to two Telegram bots (skuefq_bot / ID 8384531459, komandastuk_bot / ID 7993597060) tied to a channel called "stuk komanda" created June 5, 2025. For C2 resilience, Starland queries a Polygon blockchain smart contract (0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba, function selector 0xc659f3b8) via the public polygon-rpc[.]com JSON-RPC endpoint to retrieve an XOR-encrypted fallback C2 domain, and uses api64.ipify[.]org to geolocate victims via public IP. A remote HTTP 403 response acts as a kill switch, triggering self-deletion.
Starland RAT's command set includes shellexecute (arbitrary cmd/PowerShell execution), x32/x64 (APC process-injection shellcode execution), and download (fetch and run EXE/MSI/DLL/ZIP). The shellexecute command can pull a PowerShell stager from eorthopaedics[.]com or sastoro[.]com (under /feed/ and /alpha/ paths) that deploys WLDR, a previously undocumented, entirely in-memory, three-stage PowerShell C2 agent (stager → downloader → agent) protected by a hardcoded mutex ("f2j398fj239d8j23dkkskskkkkkkkkk"). WLDR encrypts traffic with AES-256-CBC plus HMAC-SHA256 (Encrypt-then-MAC), derives keys via PBKDF2-SHA256 (5,000 iterations), binds an HWID to every C2 URL, performs an initial HTTP POST handshake (protocol v2.0.0), polls every 10 seconds over HTTPS spoofing a Chrome/124 User-Agent, and executes tasks through a 10-thread PowerShell RunspacePool (with a background-job fallback), forwarding stdout/stderr/warning streams to the C2 in real time.
Separately, x64 shellcode retrieved from web-devtools[.]com (paths /starlandfox, /x32remka, /dopfile) deploys CastleStealer, an information stealer that decrypts DPAPI- and AES-GCM app-bound-encrypted Chromium and Firefox credential stores, harvests cryptocurrency wallet browser extensions, Discord and Telegram session files, and Steam credentials, exfiltrating over raw TCP sockets; it includes a Russian-locale exclusion check and a hardcoded build-expiry timestamp as anti-analysis measures. The x32 shellcode chain instead deploys a Remcos RAT variant, a commercial RAT abused here for keylogging, webcam/screen capture, audio recording, clipboard monitoring, file management, and encrypted C2 shell access.
Cisco Talos published ClamAV signatures (Txt/Html/Py/Ps1/Win detections spanning the full kill chain) and Snort SIDs 66787-66790 and 301580 for network detection, and released a public YARA rule repository. The campaign underscores UAT-11795's growing infrastructure sophistication: staging/C2 domain separation, blockchain-anchored fallback resilience, and encrypted Telegram exfiltration channels layered atop trojanized, trusted software brands.
MITRE ATT&CK techniques used in TL-2026-1454
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.004 Asynchronous Procedure Call; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Execution
T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1129 Shared Modules; T1203 Exploitation for Client Execution; T1204.002 Malicious File
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification
Privilege Escalation
T1055 Process Injection; T1548.002 Bypass User Account Control
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools; T1685.002 Disable or Modify Cloud Log
Credential Access
T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Initial Access
Impact
Affected products and versions in Starland RAT Campaign (UAT-11795)
- Cisco (WebEx) — Webex installer (trojanized third-party redistribution)
Vulnerable versions: trojanized installer variants distributed outside official channels
Fixed in: N/A — official vendor-distributed installers unaffected - Zoom — Zoom installer (trojanized third-party redistribution)
Vulnerable versions: trojanized installer variants distributed outside official channels
Fixed in: N/A — official vendor-distributed installers unaffected - MobaXterm (Mobatek) — MobaXterm installer (trojanized third-party redistribution)
Vulnerable versions: trojanized installer variants distributed outside official channels
Fixed in: N/A — official vendor-distributed installers unaffected - DBeaver — DBeaverCE installer (trojanized third-party redistribution)
Vulnerable versions: trojanized installer variants distributed outside official channels
Fixed in: N/A — official vendor-distributed installers unaffected - FACEIT — FACEIT client installer (trojanized third-party redistribution)
Vulnerable versions: trojanized installer variants distributed outside official channels
Fixed in: N/A — official vendor-distributed installers unaffected - Microsoft — Windows (mshta.exe / HTA execution)
Vulnerable versions: all supported Windows versions with mshta.exe available
Fixed in: N/A — abuse of legitimate OS component, no patch
Remediation for Starland RAT Campaign (UAT-11795)
Immediate actions
- Block outbound traffic to windowscreenrepairnearme[.]com, aipythondevs[.]com, eorthopaedics[.]com, sastoro[.]com, web-devtools[.]com, and zynaris[.]io at DNS/proxy/firewall
- Alert on and block Telegram bot API traffic to bot IDs 8384531459 and 7993597060 where Telegram is not a sanctioned business tool
- Deploy the Cisco Talos ClamAV signature set (Txt.Downloader.Agent, Html.Downloader.Agent, Py.Loader.Agent, Ps1.Trojan.Agent, Ps1.Trojan.WLDRAgent, Win.Trojan.CastleStealer, Win.Trojan.Starland_Installer, Win.Malware.Starland, Win.Malware.Remka)
- Deploy Snort SIDs 66787-66790 and 301580 on network IDS/IPS
- Hunt for mshta.exe spawning child processes with HTA/VBScript command lines (ClickFix pattern) and for scheduled tasks named PythonLauncher-*
- Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run persistence entries added by pythonw.exe or unsigned NSIS installers
Workarounds
- Download WebEx, Zoom, MobaXterm, DBeaver, and FACEIT installers exclusively from official vendor domains and verify installer signatures before execution
- Disable the Windows Run dialog / restrict mshta.exe execution via AppLocker or WDAC for standard users
Longer-term hardening
- Enforce application allowlisting / code-signing verification for MobaXterm, WebEx, Zoom, DBeaver, and FACEIT installers
- Deploy EDR with behavioral detection for in-memory PowerShell RunspacePool execution and APC shellcode injection
- Monitor for anomalous outbound eth_call JSON-RPC requests to polygon-rpc[.]com from endpoint workstations
- Implement browser credential-store hardening (app-bound encryption) and cryptocurrency wallet extension monitoring
- User awareness training specifically covering the ClickFix ("paste and run") social-engineering technique
Timeline of Starland RAT Campaign (UAT-11795)
- UAT-11795 campaign activity begins; earliest observed telemetry places the actor active since June 2025, targeting users in the U.S. with secondary activity in Germany, Romania, and Venezuela.
- Telegram channel 'stuk komanda', used for victim-notification beaconing and displaying messages referencing Windows-binary file names, is created.
- BleepingComputer, CyberPress, IntelligentCISO, and News4Hackers publish independent coverage summarizing the Talos findings on trojanized WebEx/Zoom/MobaXterm/DBeaver/FACEIT installers.
- Talos publishes a public YARA rule repository for Starland RAT, WLDR, and associated loader/stealer components to support community detection engineering.
- Talos releases ClamAV signatures (Txt/Html/Py/Ps1/Win detections spanning the HTA downloader through Starland, WLDR, and CastleStealer stages) and Snort SIDs 66787-66790 and 301580 alongside the disclosure.
- Cisco Talos publishes its technical analysis 'UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign' (06:00, July 16, 2026), naming Starland RAT and the WLDR in-memory PowerShell C2 implant and detailing the ClickFix-to-CastleStealer/Remcos kill chain.
- TL-Intel-Harness HUNT phase ingests the SentinelOne roundup reference and opens threat TL-2026-1454 for research.
- SentinelOne publishes 'The Good, the Bad and the Ugly in Cybersecurity - Week 29,' including the UAT-11795/Starland RAT campaign and flagging the suspected ClickFix delivery vector for defenders.
Sources cited for Starland RAT Campaign (UAT-11795)
- UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
- Russian hackers trojanize WebEx, Zoom apps to push Starland malware
- UAT-11795 Deploys Starland RAT and WLDR Backdoor Through Trojanized Software Installers
- Researchers warn of malware campaign using trojanised business software
- Russian Hackers Trojanize WebEx and Zoom to Spread Starland Malware
- Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign
- The Good, the Bad and the Ugly in Cybersecurity - Week 29
Threats related to Starland RAT Campaign (UAT-11795)
- UAT-11795 (Russian) Trojanizes WebEx, Zoom, MobaXterm, DBeaver, FaceIT Installers to Deploy Starland RAT and Bespoke WLDR C2 Implant
- UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign
- ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
- SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake CAPTCHA Pages
- Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
Detection coverage for TL-2026-1454
As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1454 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1454
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.