Threats Tagged 'powershell implant'
View all threats tagged with 'powershell implant'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'powershell implant'
Click on any threat for detailed analysis and mitigation recommendations
Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign 0 A Russian-speaking financially motivated threat actor known as UAT-11795 has been conducting a campaign since June 2025 targeting users in the United States and Europe. The campaign uses trojanized installers of legitimate software to deliver a Python-based remote access tool called Starland RAT and a PowerShell-based command-and-control implant named WLDR agent. The operation aims to harvest credentials and steal cryptocurrency wallet assets while maintaining persistence for further payload delivery. Additional malware such as CastleStealer and Remcos RAT are also used. The infrastructure includes distributed staging, C2 domains, Telegram bots for notifications, and a Polygon smart contract fallback for C2 resolution. Join the discussion | AlienVault OTX General | 07/16/2026, 11:34:02 UTC Added: 07/17/2026, 00:32:32 UTC |
Showing 1 to 1 of 1 result