# Russian Threat Actor UAT-11795 Deploys Starland RAT via Trojanized Installer Attack Campaign


A financially motivated Russian threat actor is actively distributing a new remote access trojan (RAT) called Starland through trojanized installers of legitimate software applications, according to a new analysis from Cisco Talos. The campaign, attributed to the threat group UAT-11795, has been operating since at least June 2025 and shows no signs of slowing down, with victims spanning the United States, Germany, Romania, and Venezuela.


The attacks leverage trojanized versions of popular applications including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT—software commonly used by enterprise employees and developers. Once installed, Starland RAT establishes persistence, steals credentials and cryptocurrency wallet data, and delivers additional payloads including the CastleStealer info-stealer and Remcos RAT.


## The Threat: A Multi-Stage Attack Campaign


UAT-11795 represents a sophisticated threat that combines social engineering with technical precision. The threat actor's primary objective is financial: stealing cryptocurrency assets, browser credentials, and sensitive system information that can be monetized or used for further compromise.


Key Attack Characteristics:


  • Distribution Method: Trojanized software installers, likely distributed via ClickFix social engineering
  • Geographic Focus: Primarily United States, with secondary victims in Central Europe and South America
  • Attack Duration: Active since at least June 2025—over a year of continuous operations
  • Primary Targets: Users downloading software from unofficial sources or clicking malicious links

    • What makes this campaign particularly dangerous is its reliance on legitimate software packages as delivery vectors. Users who believe they are installing trustworthy applications are instead compromising their systems with sophisticated malware toolkits.


    ## Technical Details: The Starland RAT Breakdown


    The Starland remote access trojan is a fully-featured backdoor with extensive reconnaissance and data-stealing capabilities. According to Cisco Talos' analysis, the malware performs multiple functions once executed:


    Data Exfiltration Targets:


    | Data Category | Specific Targets |

    |---|---|

    | Cryptocurrency | 40+ desktop and browser-extension wallets |

    | Browser Credentials | Stored passwords and autofill data |

    | System Information | HWID, RAM, processor, OS, antivirus details |

    | Network Intelligence | Active Directory structure, domain controllers, user privileges |

    | Session Tokens | Discord, Telegram, Steam credentials |


    Operational Capabilities:


  • Desktop and window screenshots
  • Shell command execution
  • Shellcode injection (32-bit and 64-bit)
  • Additional payload deployment (EXEs, MSIs, DLLs, ZIPs)
  • Clipboard monitoring
  • Sandbox detection and evasion

    • ## Attack Chain Deep Dive


    The infection begins with an HTA (HTML Application) file that serves as the initial loader. This HTA file retrieves and executes a trojanized NSIS (Nullsoft Scriptable Install System) installer—the same format used by legitimate software vendors, which helps evade both user suspicion and security tools.


    Stage 1: HTA Loader

    The HTA file acts as a lightweight downloader, fetching the next-stage payload from attacker-controlled infrastructure. This separation allows attackers to update delivery mechanisms without rebuilding the entire malware chain.


    Stage 2: Python Loader Disguised as LICENSE.txt

    Inside the NSIS installer lies a Python script masquerading as a license file. This loader performs several persistence techniques:

  • Modifies Windows Registry to auto-start the malware
  • Adds scheduled tasks that execute on system events
  • Modifies Startup folder entries

    • Stage 3: Starland RAT Deployment

    The loader decrypts and executes the Starland RAT payload using encryption keys embedded in the Python script. Starland immediately:

  • Checks for sandbox/virtual machine environments (defeating automated analysis)
  • Establishes persistence through multiple mechanisms
  • Attempts privilege escalation
  • Begins enumerating the compromised system

    • Stage 4: Secondary Payload Injection

    Depending on the victim's system architecture and value, Starland injects shellcode chains:


  • 64-bit Chain: Delivers CastleStealer, an information-stealing malware targeting:

    • - Browser credential stores

    - Cryptocurrency wallet seed phrases and private keys

    - Chat application sessions

    - Gaming platform credentials

    - Filesystem files for additional sensitive data


  • 32-bit Chain: Deploys Remcos RAT, a commercial remote access tool providing:

    • - Keystroke logging

    - Webcam and screen capture

    - Audio recording capabilities

    - File management and lateral movement


    ## Command-and-Control Infrastructure and Redundancy


    A critical innovation in Starland's architecture is its resilient C2 communication design. The malware connects to hardcoded command-and-control servers, but if these primary addresses become unreachable, it has a fallback mechanism that queries a Polygon smart contract for encrypted backup domains.


    This blockchain-based fallback is particularly sophisticated: it queries public blockchain data (which cannot be easily shut down) to retrieve XOR-encrypted C2 addresses. This technique makes takedowns significantly more difficult for law enforcement and cybersecurity teams.


    Additionally, Talos discovered that UAT-11795 operates a previously undocumented PowerShell C2 framework called WLDR that:

  • Uses PBKDF2-SHA256 encryption for all communications
  • Operates entirely in memory (avoiding disk detection)
  • Binds payload delivery to each victim's unique hardware identifier
  • Employs encrypted beaconing for stealth

    • ## Implications for Organizations


    This campaign reveals several critical risks facing modern enterprises:


    Supply Chain Trust Erosion: Software distribution remains a vulnerable vector. Even users attempting to download from official sources can be redirected to malicious mirrors or intercepted by network-level attacks.


    Cryptocurrency as a Priority Target: The malware's sophisticated cryptocurrency wallet enumeration (40+ wallet types) demonstrates that financial theft is the primary objective. Organizations with crypto holdings or personnel with significant digital assets should be especially vigilant.


    Privilege Escalation as a Stepping Stone: Starland's attempts to escalate privileges suggest UAT-11795 is interested in lateral movement and establishing persistence across enterprise networks, not just individual endpoints.


    Dual-Purpose Malware Chains: The use of both info-stealers and remote access trojans allows attackers to extract immediate value (credentials, crypto) while maintaining long-term access for future operations.


    ## Defense Recommendations


    Organizations should implement a multi-layered defense strategy:


    Immediate Actions:


  • Download software exclusively from official vendor websites (verify SSL certificates)
  • Implement application allowlisting to prevent unauthorized executables
  • Monitor for the Cisco Talos indicators of compromise (IoCs) in network and endpoint logs
  • Review Active Directory for suspicious scheduled tasks and registry modifications

    • Detection and Monitoring:


  • Deploy EDR solutions configured to detect:

    • - HTA file execution

    - Suspicious Python processes spawning system processes

    - Unusual registry modifications related to persistence

    - Outbound connections to Polygon smart contract infrastructure

  • Monitor for CastleStealer and Remcos indicators of compromise

    • Long-Term Security Posture:


  • Enforce strong endpoint security with behavioral detection
  • Implement hardware-based credential storage for cryptocurrency assets
  • Conduct regular security awareness training on social engineering and ClickFix tactics
  • Use secure password managers to prevent browser credential theft
  • Monitor browser extensions for malicious modifications

    • ---


    ## HackWire Analysis


    This campaign represents a maturation of financially-motivated Russian cybercrime, moving beyond simple credential theft toward sophisticated multi-stage attacks that target both immediate value (cryptocurrency) and persistent access (RAT deployment). What's particularly notable is the Polygon smart contract fallback mechanism—this isn't new technology, but its adoption by criminal groups signals a troubling trend: the normalization of blockchain infrastructure for malware command-and-control.


    The simultaneous deployment of CastleStealer and Remcos RAT shows UAT-11795 operates with industrial discipline. They're not fishing for quick hits; they're establishing footholds for deeper, more lucrative operations. The fact that this campaign has run undetected for 13+ months across multiple countries suggests their infrastructure is working as intended.


    The hidden risk here is supply chain trust degradation. Users are told "download from official sources," but trojanized installers blur that line. If attackers can compromise the delivery mechanism for popular tools like WebEx and Zoom, the average user has limited recourse. This points to a broader defense gap: we need cryptographic verification of software binaries at install time, not just at download time. Until vendors implement widespread code signing verification that the average user can understand, these attacks will remain viable.


    For defenders, the lesson is simple: assume your users will download software from untrusted sources, because they will. EDR solutions that catch Python loaders and HTA execution patterns become your first real line of defense—not user behavior change.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)