Threats Tagged 'trojanized installers'

Microsoft released an unprecedented 622 vulnerability patches in July's Patch Tuesday, including 62 critical issues and three zero-days, two of which are actively exploited. This volume of patches is significantly higher than previous years and is attributed to AI-accelerated vulnerability research. The surge in discovered vulnerabilities and patches places considerable strain on IT teams, especially smaller organizations, due to challenges in patch deployment and testing. Organizations must adapt to a potentially sustained high-volume patching environment, balancing operational stability with security needs. The threat intelligence also highlights related malware and adversary activity linked to financial motivation and cryptocurrency theft, involving various remote access trojans and trojanized installers. The situation underscores the evolving threat landscape and the operational pressures on defenders.

MediumMalwareUnited States#castlestealer#starland rat#remcos rat

A Russian-speaking financially motivated threat actor known as UAT-11795 has been conducting a campaign since June 2025 targeting users in the United States and Europe. The campaign uses trojanized installers of legitimate software to deliver a Python-based remote access tool called Starland RAT and a PowerShell-based command-and-control implant named WLDR agent. The operation aims to harvest credentials and steal cryptocurrency wallet assets while maintaining persistence for further payload delivery. Additional malware such as CastleStealer and Remcos RAT are also used. The infrastructure includes distributed staging, C2 domains, Telegram bots for notifications, and a Polygon smart contract fallback for C2 resolution.

MediumMalwareUnited StatesGermanyRomania#credential harvesting#trojanized installers#python rat