The Russian threat actor UAT-11795 employs trojanized installers of legitimate applications including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT to deploy the Starland RAT. The infection chain begins with an HTA file that downloads a trojanized NSIS installer containing a Python loader, which establishes persistence by modifying the Windows Registry and decrypts the Starland RAT. Starland collects browser and cryptocurrency wallet data, system hardware and software details, and Active Directory information. It also captures screenshots, executes shell commands, injects shellcode (32- and 64-bit), and downloads additional payloads. The 64-bit shellcode delivers CastleStealer info-stealer malware, while the 32-bit chain delivers Remcos RAT, which provides keylogging, webcam capture, audio recording, and remote command execution. The malware uses a redundant C2 communication method involving a Polygon smart contract and an undocumented PowerShell C2 framework called WLDR that operates in memory with encrypted communications. The attacks have been ongoing since mid-2025, primarily targeting U.S. users but also affecting Germany, Romania, and Venezuela. Cisco Talos recommends using IoCs for detection and advises downloading software only from official sources.

The Starland RAT campaign enables attackers to steal sensitive credentials, including browser and cryptocurrency wallet data, and gather detailed system and network information such as Active Directory domain structure and privileges. The malware’s capabilities include persistence, privilege escalation, remote command execution, and delivery of additional malware payloads (CastleStealer and Remcos RAT), which further compromise victim systems by stealing credentials, monitoring user activity, and enabling remote control. This can lead to significant data theft, financial loss, and unauthorized access within targeted environments.

No official patch or fix is available for this malware campaign. Organizations should leverage the indicators of compromise (IoCs) published by Cisco Talos to detect and respond to infections. Users should avoid executing unknown commands found online and only download software from verified official vendor portals. Employing endpoint detection and response (EDR) solutions that can detect the described behaviors and payloads is recommended. Regularly updating security tools to recognize Starland RAT and associated malware is advised.