# Starland RAT Campaign (UAT-11795) — Trojanized WebEx, Zoom, MobaXterm, DBeaver & FACEIT Installers Deliver Python RAT and Novel WLDR PowerShell C2 Implant

> UAT-11795, a Russian-speaking financially-motivated threat actor active since at least June 2025, lures victims via ClickFix-style social engineering into running an HTA downloader that deploys trojanized NSIS installers for WebEx, Zoom, MobaXterm, DBeaver, and FACEIT. A bundled Python loader decrypts the novel Starland RAT, which harvests credentials and 40+ cryptocurrency wallet types, and can hand off to a bespoke in-memory PowerShell C2 framework (WLDR) or drop CastleStealer (x64) / a Remcos RAT variant (x32) via shellcode injection.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1454
- **ID:** TL-2026-1454
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAT-11795 (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

UAT-11795 is a financially-motivated, Russian-speaking threat actor first observed by Cisco Talos operating since at least June 2025, targeting users primarily in the United States with secondary activity in Germany, Romania, and Venezuela. The actor's initial access relies on a ClickFix social-engineering technique that tricks victims into copy-pasting and executing a command that invokes mshta.exe to retrieve a weaponized HTA file. The HTA embeds VBScript (containing Russian-language developer comments) that drops a batch file to the user's temp folder and establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key.

The HTA stage then retrieves trojanized NSIS installers that repackage legitimate software — MobaXterm, WebEx, Zoom, DBeaverCE, and FACEIT — bundled with a malicious Python loader disguised as a LICENSE.txt text file. The loader is byte-compiled Python that XOR-decrypts (key 0xC6) and executes an embedded Python RAT in memory, dubbed Starland RAT by Talos. Starland RAT performs sandbox/analysis evasion (checking for WDAGUtilityAccount, Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis artifacts and hardcoded sandbox usernames), establishes persistence via randomized "PythonLauncher-*" scheduled tasks (AtLogOn trigger) and a Startup-folder LNK targeting pythonw.exe, and attempts UAC elevation via ShellExecuteW's "runas" verb.

Once active, Starland RAT enumerates the host (HWID derived from the C: volume serial, RAM, CPU, installed AV products), performs Active Directory reconnaissance (Get-CimInstance, nltest), captures in-memory Base64-encoded PNG screenshots, and scans for 40+ cryptocurrency wallet types alongside browser data. It beacons every 50-60 seconds over XOR-encrypted (key "helo1") Base64 JSON to hardcoded C2 domains windowscreenrepairnearme[.]com and aipythondevs[.]com, and separately reports victim fingerprints and wallet inventories to two Telegram bots (skuefq_bot / ID 8384531459, komandastuk_bot / ID 7993597060) tied to a channel called "stuk komanda" created June 5, 2025. For C2 resilience, Starland queries a Polygon blockchain smart contract (0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba, function selector 0xc659f3b8) via the public polygon-rpc[.]com JSON-RPC endpoint to retrieve an XOR-encrypted fallback C2 domain, and uses api64.ipify[.]org to geolocate victims via public IP. A remote HTTP 403 response acts as a kill switch, triggering self-deletion.

Starland RAT's command set includes shellexecute (arbitrary cmd/PowerShell execution), x32/x64 (APC process-injection shellcode execution), and download (fetch and run EXE/MSI/DLL/ZIP). The shellexecute command can pull a PowerShell stager from eorthopaedics[.]com or sastoro[.]com (under /feed/ and /alpha/ paths) that deploys WLDR, a previously undocumented, entirely in-memory, three-stage PowerShell C2 agent (stager → downloader → agent) protected by a hardcoded mutex ("f2j398fj239d8j23dkkskskkkkkkkkk"). WLDR encrypts traffic with AES-256-CBC plus HMAC-SHA256 (Encrypt-then-MAC), derives keys via PBKDF2-SHA256 (5,000 iterations), binds an HWID to every C2 URL, performs an initial HTTP POST handshake (protocol v2.0.0), polls every 10 seconds over HTTPS spoofing a Chrome/124 User-Agent, and executes tasks through a 10-thread PowerShell RunspacePool (with a background-job fallback), forwarding stdout/stderr/warning streams to the C2 in real time.

Separately, x64 shellcode retrieved from web-devtools[.]com (paths /starlandfox, /x32remka, /dopfile) deploys CastleStealer, an information stealer that decrypts DPAPI- and AES-GCM app-bound-encrypted Chromium and Firefox credential stores, harvests cryptocurrency wallet browser extensions, Discord and Telegram session files, and Steam credentials, exfiltrating over raw TCP sockets; it includes a Russian-locale exclusion check and a hardcoded build-expiry timestamp as anti-analysis measures. The x32 shellcode chain instead deploys a Remcos RAT variant, a commercial RAT abused here for keylogging, webcam/screen capture, audio recording, clipboard monitoring, file management, and encrypted C2 shell access.

Cisco Talos published ClamAV signatures (Txt/Html/Py/Ps1/Win detections spanning the full kill chain) and Snort SIDs 66787-66790 and 301580 for network detection, and released a public YARA rule repository. The campaign underscores UAT-11795's growing infrastructure sophistication: staging/C2 domain separation, blockchain-anchored fallback resilience, and encrypted Telegram exfiltration channels layered atop trojanized, trusted software brands.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1059.005 Visual Basic
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1129 Shared Modules
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1547.009 Shortcut Modification
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1685.002 Disable or Modify Cloud Log
- T1112 Modify Registry
- T1055.004 Asynchronous Procedure Call
- T1497.001 System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1482 Domain Trust Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1056.001 Keylogging
- T1115 Clipboard Data
- T1123 Audio Capture
- T1125 Video Capture
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1008 Fallback Channels

## Sources

- [UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign](https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/)
- [Russian hackers trojanize WebEx, Zoom apps to push Starland malware](https://www.bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/)
- [UAT-11795 Deploys Starland RAT and WLDR Backdoor Through Trojanized Software Installers](https://cyberpress.org/uat-11795-spreads-dual-backdoors/)
- [Researchers warn of malware campaign using trojanised business software](https://www.intelligentciso.com/2026/07/16/researchers-warn-of-malware-campaign-using-trojanised-business-software/)
- [Russian Hackers Trojanize WebEx and Zoom to Spread Starland Malware](https://www.news4hackers.com/russian-hackers-trojanize-webex-and-zoom-to-spread-starland-malware)
- [Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign](https://radar.offseq.com/threat/novel-starland-rat-and-bespoke-wldr-c2-implant-dep-e6ab953c0d52f095)
- [The Good, the Bad and the Ugly in Cybersecurity - Week 29](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-29-8/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1454