Russian hackers trojanize WebEx, Zoom apps to push Starland malware

1. Executive summary

A financially motivated Russian threat actor tracked as "UAT-11795" is distributing trojanized installers for common enterprise and developer software — including Cisco WebEx, Zoom, MobaXterm, DBeaver, and FACEIT — to deploy a novel Python-based backdoor dubbed "Starland RAT." Active since at least June 2025, the campaign is predominantly observed in the United States, with additional passive DNS resolution impacts detected in Germany, Romania, and Venezuela, placing it within EMEA visibility. The malware steals credentials, cryptocurrency wallet data, and Active Directory information, and deploys secondary payloads including the CastleStealer info-stealer and Remcos RAT. Attribution to UAT-11795 is unconfirmed: the actor has no MITRE ATT&CK profile in the verified reference data.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: The actor "UAT-11795" has no MITRE ATT&CK profile in the verified reference data. Attribution is unconfirmed and rests solely on Cisco Talos' reporting (single-sourced; verify before enforcement).

Attack chain (confirmed steps from Cisco Talos)

1. Initial delivery (suspected ClickFix): The infection vector is unconfirmed. Talos speculates the malicious files are pushed using the "ClickFix" technique — likely tricking users into executing a weaponized HTA (HTML Application) file. The HTA downloader is executed via Microsoft HTML Application Host (mshta.exe).
2. Trojanized installer retrieval: The HTA file downloads and executes a trojanized NSIS installer. Observed trojanized installer filenames include: - MobaXterm_v26.1.exe - WebEx_Client.exe - Zoom installer (exact filename not specified) - dbeaver-ce-windows-x86_64.exe - FaceitInstaller_x64.exe
3. Python loader execution: The NSIS script inside the trojanized installer executes malicious byte-compiled Python code disguised as a text file (LICENSE.txt). The installer sends an implant status beacon to an attacker-controlled Telegram bot.
4. Persistence via registry: The Python loader modifies the Windows Registry to establish persistence, then decrypts and loads the Starland RAT payload.
5. Starland RAT execution: Upon launch, Starland performs sandbox checks, adds scheduled tasks and Startup folder items for additional persistence, and attempts privilege escalation.
6. Data theft: Starland harvests: - Browser data and cryptocurrency wallet assets (40+ desktop and browser-extension wallets) - System details: HWID (derived from C: drive volume serial number), RAM, processor, OS, computer name, region, public IP, installed AV products - Active Directory information: domain structure, domain controllers, victim's domain privileges
7. Secondary payload delivery: Starland can execute shellcode and download additional payloads (EXEs, MSIs, DLLs, ZIPs). In observed attacks: - 64-bit shellcode chain delivers CastleStealer (targets browser credentials, crypto wallets, Discord/Telegram sessions, Steam credentials, filesystem files) - 32-bit shellcode chain delivers Remcos RAT (keylogging, webcam/screen capture, audio recording, clipboard monitoring, file management, remote command execution)

C2 infrastructure

• Staging domains: eorthopaedics[.]com (likely hijacked), web-devtools[.]com, zynaris[.]io
• Starland RAT primary C2: windowscreenrepairnearme[.]com (likely hijacked), aipythondevs[.]com
• Parallel C2 (HWID-encrypted envelopes): eorthopaedics[.]com (URL path /feed/), sastoro[.]com (URL path /alpha/)
• All C2 URLs incorporate the victim's hardware identifier (C: drive volume serial number) as the final URL path component.
• Blockchain fallback C2: A Polygon smart contract (0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba) stores an XOR-encrypted fallback C2 domain, retrievable via public JSON-RPC call.
• Telegram notification bots: 8384531459 ("skuefq_bot") and 7993597060 ("komandastuk_bot") — receive execution notification beacons with victim machine fingerprints and cryptocurrency wallet inventories.
• Telegram C2 channel: "stuk komanda" (created June 5, 2025; 3 subscribers; structured like C2; lists messages named after Windows binary filenames).

WLDR C2 framework

Talos also identified a previously undocumented PowerShell C2 framework called "WLDR" used by UAT-11795. WLDR uses PBKDF2-SHA256 encrypted beaconing, operates entirely in memory, and binds payload delivery to each victim's hardware identifier.

4. Mitigation & containment

P1 — Within 24 hours

• Block C2 infrastructure at network perimeter and DNS resolver:
• eorthopaedics[.]com, web-devtools[.]com, zynaris[.]io, sastoro[.]com, windowscreenrepairnearme[.]com, aipythondevs[.]com
• Block Telegram bot IDs 8384531459 and 7993597060 via network proxy if Telegram is permitted in the environment.
• Hunt for trojanized installers across endpoints: search for MobaXterm_v26.1.exe, WebEx_Client.exe, dbeaver-ce-windows-x86_64.exe, FaceitInstaller_x64.exe in user-writable directories (Downloads, AppData, Temp). Quarantine any matches outside of approved software distribution paths.
• Monitor for mshta.exe executing from user contexts or launching external network connections — indicative of ClickFix-style HTA delivery.
• EDR rule: Alert on mshta.exe spawning child processes or making outbound HTTP/HTTPS requests.

P2 — Within 72 hours

• Hunt for Starland persistence mechanisms:
• Suspicious scheduled tasks created by non-standard user contexts
• Unexpected files in Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup)
• Unexplained Windows Registry modifications in Run/RunOnce keys
• Search for LICENSE.txt files co-located with recently installed software in user directories — this is the Python loader disguise.
• Monitor for Polygon blockchain RPC calls to public endpoints from workstations — the smart contract 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba is used for C2 fallback. Block or alert on JSON-RPC calls to public Polygon nodes from non-developer endpoints.
• Hunt for WLDR framework: Search for in-memory PowerShell processes using PBKDF2-SHA256 encryption patterns or beaconing behaviour bound to hardware identifiers.
• Review AD reconnaissance activity: Starland queries domain structure, domain controllers, and domain privileges. Monitor for unusual LDAP queries or nltest / net commands from workstations.

P3 — Within 7 days

• Enforce software acquisition policy: All software downloads must originate from confirmed official vendor portals. Block third-party software download aggregators at the web proxy. Communicate the ClickFix social-engineering vector to staff — specifically the risk of copying/pasting commands from web pages.
• Application allowlisting: Ensure only approved, centrally distributed versions of MobaXterm, WebEx, Zoom, DBeaver, and FACEIT are permitted to execute.
• Cryptocurrency wallet monitoring: If corporate endpoints are permitted to hold wallet extensions, audit for the 40+ wallet types targeted by Starland and CastleStealer.
• Remcos RAT detection: Deploy detection rules for Remcos default behaviours (keylogging, webcam access, audio recording) if not already in place.

5. Indicators of compromise

domain  eorthopaedics[.]com
domain  web-devtools[.]com
domain  zynaris[.]io
domain  sastoro[.]com
domain  windowscreenrepairnearme[.]com
domain  aipythondevs[.]com
telegram_bot  8384531459
telegram_bot  7993597060
polygon_contract  0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba
filename  MobaXterm_v26.1.exe
filename  WebEx_Client.exe
filename  dbeaver-ce-windows-x86_64.exe
filename  FaceitInstaller_x64.exe
filename  LICENSE.txt
process  mshta.exe

6. Detection

rule Starland_RAT_Loader_Strings {
  meta:
    author = "Adverse Trace"
    date = "2026-07-16"
    reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/"
    description = "Detects Starland RAT loader artefacts: trojanized installer filenames and disguised Python loader"
  strings:
    $installer1 = "MobaXterm_v26.1.exe" ascii
    $installer2 = "WebEx_Client.exe" ascii
    $installer3 = "dbeaver-ce-windows-x86_64.exe" ascii
    $installer4 = "FaceitInstaller_x64.exe" ascii
    $loader = "LICENSE.txt" ascii
    $c2_path1 = "/feed/" ascii
    $c2_path2 = "/alpha/" ascii
    $bot1 = "skuefq_bot" ascii
    $bot2 = "komandastuk_bot" ascii
    $channel = "stuk komanda" ascii
  condition:
    3 of them
}

title: Suspicious mshta.exe Execution - Potential ClickFix HTA Downloader
id: 7a3c1f2e-2026-0716-315
status: experimental
description: Detects mshta.exe making outbound network connections or spawning child processes, consistent with ClickFix-style HTA delivery used by UAT-11795
author: Adverse Trace
date: 2026/07/16
references:

  - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
  category: process_creation
  product: windows
detection:
  selection_mshta:
    Image|endswith: '\mshta.exe'
  selection_network:
    Image|endswith: '\mshta.exe'
    DestinationIp|exists: true
  selection_child:
    ParentImage|endswith: '\mshta.exe'
  condition: selection_mshta and (selection_network or selection_child)
falsepositives:

  - Legitimate HTA application usage (rare in enterprise environments)
level: high

title: Starland RAT C2 Domain Communication
id: 8b4d2a3f-2026-0716-315
status: experimental
description: Detects DNS queries or HTTP connections to Starland RAT C2 infrastructure
author: Adverse Trace
date: 2026/07/16
references:

  - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|contains:

      - 'eorthopaedics.com'
      - 'web-devtools.com'
      - 'zynaris.io'
      - 'sastoro.com'
      - 'windowscreenrepairnearme.com'
      - 'aipythondevs.com'
  condition: selection
falsepositives:

  - None expected
level: critical

title: Trojanized Software Installer Execution from User Directory
id: 9c5e3b4a-2026-0716-315
status: experimental
description: Detects execution of known trojanized installer filenames from user-writable paths
author: Adverse Trace
date: 2026/07/16
references:

  - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
  category: process_creation
  product: windows
detection:
  selection_filename:
    Image|endswith:

      - '\MobaXterm_v26.1.exe'
      - '\WebEx_Client.exe'
      - '\dbeaver-ce-windows-x86_64.exe'
      - '\FaceitInstaller_x64.exe'
  selection_path:
    Image|contains:

      - '\Downloads\'
      - '\AppData\'
      - '\Temp\'
      - '\Desktop\'
  condition: selection_filename and selection_path
falsepositives:

  - Legitimate installer execution from user directories (should be rare in managed environments with software distribution)
level: high

7. Sources

• Cisco Talos, "UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign," https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/, 2026-07-16
• BleepingComputer, "Russian hackers trojanize WebEx, Zoom apps to push Starland malware," https://www.bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/, 2026-07-16

8. Adverse Trace position

This is a high-severity campaign for EMEA financial services. While the primary victim concentration is in the United States, passive DNS data confirms C2 resolution from Germany and Romania, meaning EMEA exposure is active. The targeting of enterprise collaboration tools (WebEx, Zoom) and developer/IT admin utilities (MobaXterm, DBeaver) is directly relevant to financial services environments where these tools are standard. The malware's Active Directory reconnaissance capability elevates risk: a single infected developer or IT admin workstation could expose domain structure and privilege mappings. The blockchain-based C2 fallback (Polygon smart contract) makes infrastructure takedown significantly harder, as the fallback domain can be rotated without DNS changes. Attribution to UAT-11795 is unconfirmed (no MITRE profile; single-sourced to Cisco Talos — verify before enforcement). We will continue monitoring for additional EMEA victim telemetry and any expansion of the trojanized installer catalogue. Clients should prioritise P1 network blocking and endpoint hunting for trojanized installers in user-writable directories.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.