UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Summary: Cisco Talos reports UAT-11795 distributing trojanized installers for MobaXterm, WebEx, Zoom, DBeaver and FACEIT to deliver a Python-based RAT called Starland, which steals browser data and cryptocurrency wallets and pulls a fallback C2 address from a Polygon smart contract. The campaign uses ClickFix-style HTA downloaders, sends execution beacons to two actor-controlled Telegram bots, and can follow up with CastleStealer, a Remcos RAT variant, or a bespoke PowerShell implant tracked as WLDR C2.
Key Takeaway: The lures are the everyday tools on your developers' and IT admins' machines, and the actor is running them at volume across multiple victim profiles rather than picking one target. A single execution beacon to the actor's Telegram bot confirms the compromise before your tooling has anything to alert on.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026