Cisco Talos disclosed UAT-11795 as a financially motivated, Russian-speaking adversary conducting malicious campaigns since mid-2025 targeting U.S. and European users. The group deploys a novel Starland RAT and a bespoke WLDR C2 implant, indicating custom tooling and targeted operations. The disclosure does not specify exploited vulnerabilities or affected software versions, focusing instead on the threat actor's tactics and implants. No known exploits or patches are reported, and the campaign is characterized by medium severity based on the impact and sophistication described.

The threat actor uses custom malware implants (Starland RAT and WLDR C2) to compromise targeted users, potentially enabling unauthorized access and control. The campaign targets users in the U.S. and Europe, posing risks to confidentiality, integrity, and availability of affected systems. However, no specific exploited vulnerabilities or widespread exploitation have been documented. The medium severity reflects the sophistication and targeted nature of the campaign without evidence of large-scale impact or critical vulnerabilities.

No specific patches or fixes are available as no software vulnerabilities have been identified. Organizations should refer to Cisco Talos advisories for updates and monitor for indicators of compromise related to Starland RAT and WLDR C2 implants. Standard detection and response measures focused on identifying these implants and their network activity are recommended. Since this is a targeted campaign, tailored threat hunting and endpoint monitoring are appropriate. Patch status is not applicable; check the vendor advisory for any future updates.