Begun, the Patch Wars have

1. Executive summary

Cisco Talos has disclosed an active, financially motivated campaign by actor "UAT-11795" (no MITRE ATT&CK profile — attribution unconfirmed) distributing trojanized installers for Webex, Zoom, MobaXterm, DBeaver, and FACEIT to deliver a custom Python-based "Starland RAT" and an in-memory PowerShell C2 implant tracked as "WLDR agent." The campaign, active since at least June 2025, employs AMSI/ETW bypasses, blockchain-anchored C2 fallback via a Polygon smart contract, and Telegram bots for victim beaconing; secondary payloads include CastleStealer and Remcos RAT targeting credentials and cryptocurrency assets. Separately, Microsoft's July 2026 Patch Tuesday shipped a record 622 vulnerability fixes (62 critical), including three zero-days with two under active exploitation — a volume attributed to AI-accelerated vulnerability research that threatens to overwhelm standard change-management cycles. EMEA financial services face dual pressure: an opportunistic malware campaign targeting developer and collaboration tooling, and an unprecedented patch load demanding rapid triage.

2. Regulatory framing

3. Technical analysis & attack chain

UAT-11795 Campaign — Starland RAT / WLDR Agent

Attribution caveat: Actor "UAT-11795" has no MITRE ATT&CK profile in the verified reference data. Attribution as a "sophisticated, financially motivated Russian-speaking adversary" rests solely on Cisco Talos reporting (single-sourced; verify before enforcement).

Confirmed attack chain (corroborated across Talos newsletter and detailed blog post)

1. Initial access — ClickFix social engineering: The attacker uses a ClickFix technique to deliver a weaponised HTA downloader executed via mshta.exe on the victim's machine. The HTA file triggers download and execution of a trojanized software installer.
2. Trojanized installer execution: The installer (NSIS-packaged) bundles a legitimate application with a malicious Python package. Observed trojanized installers include: - MobaXterm_v26.1.exe (MobaXterm — SSH/RDP/network admin terminal) - WebEx_Client.exe and a Zoom installer (Cisco WebEx and Zoom — video conferencing) - dbeaver-ce-windows-x86_64.exe (DBeaver Community Edition — database management/SQL client) - FaceitInstaller_x64.exe (FACEIT — online gaming platform)
3. Implant beacon — Telegram notification: The malicious Python code sends an execution status notification to an attacker-controlled Telegram bot, including the victim's machine fingerprint.
4. Starland RAT deployment: The Python-based Starland RAT establishes C2 communication. Primary C2 domains: windowscreenrepairnearme[.]com and aipythondevs[.]com. All C2 URLs incorporate a victim hardware identifier derived from the C: drive volume serial number as the final URL path component, enabling per-victim C2 channel separation.
5. WLDR agent deployment: Starland RAT acts as a gateway to deploy the WLDR agent — a bespoke, in-memory PowerShell C2 implant. The WLDR agent operates from memory, executing PowerShell scripts without disk-based artefacts.
6. Evasion — AMSI and ETW bypass: The campaign employs AMSI (Anti-Malware Scan Interface) and ETW (Event Tracing for Windows) bypasses to avoid detection by endpoint security tooling.
7. C2 resilience — blockchain fallback: The actor stores an XOR-encrypted fallback C2 domain in a Polygon smart contract at address 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba. The fallback domain is retrievable via a public JSON-RPC call, ensuring C2 persistence even if primary domains are sinkholed or taken down.
8. Parallel C2 infrastructure: Domains eorthopaedics[.]com (under /feed/ path) and sastoro[.]com (under /alpha/ path) serve HWID-encrypted envelopes over HWID-parameterised URL paths — parallel C2 infrastructure for the same campaign.
9. Staging infrastructure: eorthopaedics[.]com (likely hijacked), web-devtools[.]com (resembles developer tooling portal), and zynaris[.]io (resembles a tech start-up) serve as payload staging domains.
10. Secondary payload deployment: Attackers deploy CastleStealer and Remcos RAT to exfiltrate high-value credentials and cryptocurrency assets.
11. Telegram C2 / logging: The actor controls two Telegram bots — 8384531459 ("skuefq_bot") and 7993597060 ("komandastuk_bot") — for receiving implant execution beacons including victim machine fingerprints and cryptocurrency wallet inventories. A private Telegram channel "stuk komanda" (created June 5, 2025; 3 subscribers) lists messages in the name of Windows binary filenames, structured like a C2 channel.

Geographic spread: Predominantly U.S. infections; fewer potential impacts observed in Germany, Romania, and Venezuela based on passive DNS resolution of C2 domains. EMEA exposure confirmed for Germany and Romania.

July 2026 Microsoft Patch Tuesday

Microsoft shipped 622 vulnerability patches — the largest Patch Tuesday on record, more than triple June's previous high of ~200. Of these:

• 62 rated critical severity
• 3 zero-days, of which 2 are actively exploited (CISA KEV status not confirmed in source material — no specific CVE IDs, CVSS scores, or KEV entry details provided)
• Microsoft attributes the volume to AI frontier-model-accelerated vulnerability research

No specific CVE IDs, CVSS scores, affected products, or patch KB numbers are available in the provided source material. The source is a newsletter summary; the underlying Patch Tuesday detail was not supplied.

Additional items referenced in the source (low detail)

• RabbitMQ vulnerability: An open management endpoint returns the OAuth secret to unauthenticated callers. No CVE, CVSS, or version details provided. (SecurityWeek, single-sourced)
• Cursor AI two-click exploit: Attackers can install permission-rich MCP servers on privileged developer machines via two clicks. No CVE or technical detail provided. (DarkReading, single-sourced)

4. Mitigation & containment

P1 — Within 24 hours

• Block known C2 and staging domains at DNS resolver, web proxy, and firewall:
• eorthopaedics[.]com, sastoro[.]com, windowscreenrepairnearme[.]com, aipythondevs[.]com, web-devtools[.]com, zynaris[.]io
• Block Polygon smart contract address 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba in any web3/cryptocurrency monitoring or egress filtering (if applicable to your environment).
• Hunt for trojanized installers — search endpoint filesystems and software inventory for the following filenames, especially outside of standard software distribution channels:
• MobaXterm_v26.1.exe, WebEx_Client.exe, dbeaver-ce-windows-x86_64.exe, FaceitInstaller_x64.exe
• Alert on mshta.exe execution originating from user-writable paths or executing remote/content URLs — this is the initial access vector.
• Tune EDR for in-memory PowerShell execution — alert on PowerShell processes with no on-disk script file, especially those creating scheduled tasks or modifying AMSI/ETW registry keys.
• Triage July 2026 Patch Tuesday: Prioritise the 2 actively exploited zero-days. Without specific CVE IDs in the source, pull the Microsoft July 2026 Patch Tuesday catalogue directly and cross-reference against CISA KEV for the exploited entries. Apply patches for actively exploited items to internet-facing assets first.

P2 — Within 72 hours

• Audit software procurement channels: Verify that all Webex, Zoom, MobaXterm, DBeaver, and FACEIT installations across the estate were obtained from vendor-verified download portals. Quarantine and rebuild any host with an installer sourced from unofficial channels.
• Deploy EDR detection for AMSI tampering: Monitor for modifications to HKLM\SOFTWARE\Microsoft\AMSI registry keys or attempts to unload/disable AMSI via reflection or patching.
• Monitor for Telegram bot C2 traffic: Alert on outbound HTTPS traffic to api.telegram.org from non-service accounts, particularly from developer workstations and admin terminals.
• Hunt for scheduled tasks created by PowerShell or mshta.exe — the campaign uses scheduled tasks for persistence.
• Apply remaining critical-severity July patches (62 total) to internet-facing and high-value assets.

P3 — Within 7 days

• Complete July 2026 Patch Tuesday deployment across the full estate; document prioritisation rationale for change advisory board records.
• User awareness briefing: Warn staff about ClickFix social engineering tactics and the risk of downloading software from unofficial sources. Specifically target developers (MobaXterm, DBeaver) and general staff (Webex, Zoom).
• Review DBeaver and MobaXterm deployment: These are developer/admin tools often installed without central procurement — consider whitelisting approved versions via application control.
• Assess RabbitMQ exposure: If RabbitMQ is deployed, check whether the management endpoint is exposed and requires authentication for OAuth secret retrieval. Restrict network access to the management interface until a patch is confirmed.

5. Indicators of compromise

Note on file hashes: The four hash sets and filenames (VID001.exe, SECOH-QAD.exe, tmp00055df5.dll, .js) appear in the Talos newsletter IOC section but are not explicitly linked to the UAT-11795 campaign narrative in the provided source material. They may be from separate Talos detections published in the same newsletter. Treat as related-but-unconfirmed until correlated with the full Talos blog.

domain  eorthopaedics[.]com
domain  sastoro[.]com
domain  windowscreenrepairnearme[.]com
domain  aipythondevs[.]com
domain  web-devtools[.]com
domain  zynaris[.]io
blockchain-address  0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba
telegram-bot-id  8384531459
telegram-bot-id  7993597060
filename  MobaXterm_v26.1.exe
filename  WebEx_Client.exe
filename  dbeaver-ce-windows-x86_64.exe
filename  FaceitInstaller_x64.exe
sha256  9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
md5  2915b3f8b703eb744fc54c81f4a9c67f
filename  VID001.exe
sha256  9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
md5  38de5b216c33833af710e88f7f64fc98
filename  SECOH-QAD.exe
sha256  90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59
md5  c2efb2dcacba6d3ccc175b6ce1b7ed0a
filename  tmp00055df5.dll
sha256  b8be9a5e0a191050f9099c11c155b436863e9bc43bc904cdb842e249679aa35a
md5  0398df5a18f71efcfeef4571a2cef577
filename  b8be9a5e0a191050f9099c11c155b436863e9bc43bc904cdb842e249679aa35a.js

Behavioural indicators

6. Detection

rule Starland_WLDR_Campaign_IOCs {
    meta:
        author = "Adverse Trace"
        date = "2026-07-16"
        reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/"
        description = "Detects Starland RAT / WLDR campaign artefacts — C2 domains, staging domains, Polygon contract address, trojanized installer filenames"
    strings:
        $c2_1 = "windowscreenrepairnearme" nocase
        $c2_2 = "aipythondevs" nocase
        $c2_3 = "eorthopaedics" nocase
        $c2_4 = "sastoro" nocase
        $staging_1 = "web-devtools" nocase
        $staging_2 = "zynaris" nocase
        $polygon = "0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba" nocase
        $installer_1 = "MobaXterm_v26.1.exe" nocase
        $installer_2 = "WebEx_Client.exe" nocase
        $installer_3 = "dbeaver-ce-windows-x86_64.exe" nocase
        $installer_4 = "FaceitInstaller_x64.exe" nocase
        $tg_bot_1 = "skuefq_bot" nocase
        $tg_bot_2 = "komandastuk_bot" nocase
        $tg_channel = "stuk komanda" nocase
    condition:
        3 of them
}

title: UAT-11795 Starland RAT Campaign — mshta.exe and In-Memory PowerShell Execution
id: 7a3c1f2e-2026-0716-at323
status: experimental
description: Detects execution patterns consistent with UAT-11795 ClickFix delivery via mshta.exe and subsequent in-memory PowerShell C2 implant (WLDR agent) activity
references:

    - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespose-wldr-c2-implant-in-financially-motivated-campaign/
author: Adverse Trace
date: 2026/07/16
tags:

    - attack.execution
    - attack.t1218.005
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:

            - 'http'
            - '.hta'
    selection_powershell_memory:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:

            - '-nop'
            - '-w hidden'
            - 'IEX'
            - 'Invoke-Expression'
            - 'FromBase64String'
    selection_powershell_amsi:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:

            - 'amsiInitFailed'
            - 'System.Management.Automation.AmsiUtils'
            - 'Reflex'
    selection_schtasks_child:
        ParentImage|endswith:

            - '\mshta.exe'
            - '\powershell.exe'
        Image|endswith: '\schtasks.exe'
    condition: selection_mshta or selection_powershell_memory or selection_powershell_amsi or selection_schtasks_child
falsepositives:

    - Legitimate HTA application deployment via mshta.exe (rare in enterprise environments)
    - Administrative PowerShell scripts using encoded commands (tune with allowlisting)
level: high

7. Sources

• Cisco Talos, "Begun, the Patch Wars have," https://blog.talosintelligence.com/begun-the-patch-wars-have/, 2026-07-16
• Cisco Talos, "UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign," https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/, 2026-07-16
• The Hacker News, "Microsoft patches record 622 flaws, including two zero-days under active attack," (referenced in Talos newsletter), 2026-07-16
• SecurityWeek, "RabbitMQ vulnerability threatens enterprise systems," (referenced in Talos newsletter), 2026-07-16
• DarkReading, "Two-click cursor exploit enables dev environment takeover," (referenced in Talos newsletter), 2026-07-16

8. Adverse Trace position

This advisory covers two concurrent developments that collectively raise the operational risk profile for EMEA financial services. The UAT-11795 campaign is a credible, active threat — single-sourced to Cisco Talos with no MITRE ATT&CK profile for the actor, so attribution remains unconfirmed — but the technical detail (trojanized installers, Python RAT, in-memory PowerShell C2, blockchain fallback, Telegram beaconing) is specific and actionable. The choice of MobaXterm and DBeaver as lures directly targets developer and database admin populations common in financial services; the Germany and Romania passive DNS hits confirm EMEA exposure. Clients should treat the C2 domain blocklist and trojanized installer filename hunt as immediate P1 actions. The July 2026 Patch Tuesday volume (622 CVEs, 62 critical, 2 actively exploited zero-days) is unprecedented and we cannot provide specific CVE IDs or CVSS scores because the source material does not include them — clients must pull the Microsoft catalogue and CISA KEV directly. We assess that AI-accelerated vulnerability disclosure will sustain elevated patch volumes for the foreseeable future, and we recommend clients review whether their current change-management cadence can absorb this load. Adverse Trace will monitor for the full Talos IOC dump, specific July Patch Tuesday CVE details, and any CISA KEV additions, and will issue a supplemental advisory if the campaign is observed targeting EMEA financial services entities specifically.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.