In July 2026, there was an unprecedented increase in vulnerability disclosures, with Microsoft alone patching 622 flaws, including critical and zero-day vulnerabilities, attributed to AI frontier research accelerating vulnerability discovery. Cisco Talos disclosed a financially motivated Russian-speaking threat actor, UAT-11795, conducting a widespread campaign since June 2025 targeting U.S. and European users. This actor uses trojanized installers of legitimate software (e.g., Webex, Zoom, MobaXterm) to deploy a custom Python-based remote access tool called Starland RAT, which facilitates further deployment of an in-memory PowerShell implant (WLDR agent). The adversary employs evasive techniques such as AMSI and ETW bypasses and a blockchain-anchored fallback for persistent command and control. Secondary payloads like CastleStealer and Remcos RAT are used to exfiltrate credentials and cryptocurrency. The report underscores the operational strain on organizations due to the volume of patches and the importance of user education and endpoint detection tuning.

The impact includes exposure to a large number of vulnerabilities, some critical and actively exploited, increasing the risk of compromise if patches are not applied timely. The UAT-11795 campaign enables attackers to gain persistent remote access through trojanized installers, leading to credential theft and cryptocurrency asset compromise. The adversary's use of advanced evasion techniques complicates detection and response. Organizations face operational challenges in patch management due to the volume and urgency of vulnerabilities disclosed.

No official patch status is provided for the vulnerabilities collectively; patch status should be verified per vendor advisories. Organizations should prioritize applying vendor patches, especially for critical and actively exploited vulnerabilities. For the UAT-11795 campaign, user education on the risks of unofficial software downloads and social engineering is essential. Monitoring for suspicious mshta.exe and PowerShell in-memory execution, as well as AMSI tampering, is recommended. Endpoint detection solutions should be tuned to detect in-memory execution and evasion techniques. Given the volume of patches, organizations should optimize change management processes to handle the increased patching load effectively.