Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign

The UAT-11795 threat actor deploys a sophisticated financially motivated campaign using trojanized installers of popular software such as MobaXterm, WebEx, Zoom, DBeaver, and FACEIT. The primary malware includes Starland RAT, a Python-based remote access tool, and the WLDR agent, a PowerShell-based memory-resident command-and-control implant with encrypted beaconing, task queuing, and a Runspace execution engine. The campaign targets credential harvesting and cryptocurrency theft, leveraging distributed C2 infrastructure with fallback mechanisms including Polygon smart contracts and Telegram bots. Alternative payloads like CastleStealer and Remcos RAT are also used. The campaign has been active since June 2025, focusing on victims in the US and Europe.

The campaign enables attackers to harvest user credentials and steal cryptocurrency wallet assets. It establishes persistent access to compromised systems for additional payload delivery, increasing the risk of further compromise and data exfiltration. The use of trojanized installers of legitimate software increases the likelihood of successful infection. The infrastructure's resilience through distributed staging, Telegram notifications, and blockchain-based fallback mechanisms complicates detection and takedown efforts.

No official patch or vendor advisory is available for this threat. Mitigation should focus on user awareness to avoid installing trojanized software, especially from unverified sources. Monitoring for indicators of compromise related to Starland RAT, WLDR agent, CastleStealer, and Remcos RAT is recommended. Network defenses should consider blocking known C2 domains and Telegram bot communications associated with this campaign. Since this is a malware campaign rather than a software vulnerability, patching is not applicable.