> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign - URL: https://f4n6.co.uk/security-feed/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ - Published: 2026-07-17T08:57:57.000Z - Updated: 2026-07-17T08:57:57.000Z - Author: Jeff Davies - Tags: #security-feed, UAT-11795 ## 1\. Executive summary Cisco Talos has disclosed a financially motivated campaign by threat actor UAT-11795 distributing trojanized installers for widely used software (MobaXterm, WebEx, Zoom, DBeaver, FACEIT) to deliver a novel Python-based "Starland RAT" and a bespoke in-memory PowerShell C2 implant tracked as "WLDR." Attribution to UAT-11795 is unconfirmed — the actor has no MITRE ATT&CK profile; the Russian-speaking designation rests on a single Russian-language developer comment in the VBScript payload. The campaign is opportunistic and volume-driven, with infections predominantly in the US but also observed in Germany, Romania, and Venezuela, engaging EMEA exposure. The attack chain features AMSI/ETW bypasses, blockchain-anchored C2 fallback via a Polygon smart contract, and deployment of secondary payloads including CastleStealer (credential and crypto-wallet theft) and Remcos RAT, posing a direct risk to financial services staff who may download trojanized IT or collaboration tooling. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | The campaign relies on trojanized installers for common enterprise tools (MobaXterm, WebEx, Zoom, DBeaver) that bypass standard application allow-listing and deliver in-memory payloads defeating signature-based controls. | Financial entities should validate that resilience testing programmes include scenarios for trojanized legitimate software and in-memory PowerShell execution, not just unpatched CVE exploitation. | | NIS2 Art. 21(2)(d): supply chain security measures | The initial access vector is trojanized software installers sourced from attacker-controlled staging domains mimicking legitimate download portals — a direct supply-chain software integrity compromise. | In-scope organisations must verify software provenance (hash verification, official source enforcement) for all administrator and developer tooling downloads as part of supply chain security measures. | ## 3\. Technical analysis & attack chain **Attribution caveat:** UAT-11795 has no MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed. The Russian-speaking actor designation is single-sourced from Talos, based on a Russian-language developer comment ("Добавление команды в автозапуск для текущего пользователя") in the VBScript payload. All technical detail below is single-sourced from Talos research. ### Attack chain 1. **Initial access (ClickFix social engineering):** The victim is enticed via a ClickFix technique to execute a command that downloads and executes a remotely hosted weaponized HTA file. The HTA stager is hosted on `zynaris[.]io`. 2. **HTA execution and dropper:** The HTA runs an embedded VBScript via `mshta.exe` that drops a Windows batch file into the user profile's temporary folder. The batch file downloads a trojanized installer from an attacker-controlled staging domain (`eorthopaedics[.]com`, `web-devtools[.]com`, or `zynaris[.]io`). 3. **Persistence (initial):** The VBScript establishes a registry Run key at `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` with the value name `MyApp`, pointing to `mshta.exe` executing the remotely hosted HTA file at every logon. 4. **Trojanized installer execution:** The batch file sends a notification beacon to Telegram bot "8384531459" ("skuefq\_bot") confirming successful execution. The trojanized installer is built with NSIS and bundles the legitimate Python runtime `pythonw.exe` with a compiled Python loader disguised as `LICENSE.txt`. The modified NSI script executes the compiled Python loader using `pythonw.exe`. 5. **Python loader and Starland RAT deployment:** The compiled Python loader is obfuscated with junk functions performing random arithmetic and printing random strings. The actual logic is six lines implementing XOR decryption with key `198` (`0xC6`) to decrypt and execute the embedded Starland RAT in memory. 6. **Anti-analysis (Starland RAT):** Before executing, the RAT checks the logged-on username against a hardcoded sandbox account list (including `WDAGUtilityAccount`) and the computer name against sandbox hostnames (Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis). It also checks for a `Zone.Identifier` alternate data stream on the trojanized installer in the Downloads folder, confirming browser-download origin. 7. **Persistence (Starland RAT):** Creates a scheduled task via PowerShell `New-ScheduledTask` with a randomized name pattern `PythonLauncher-{3 random characters}`. With admin privileges, the trigger is `AtLogOn` with `RunLevel Highest`. A secondary Startup folder LNK shortcut is created via `WScript.Shell` COM object, targeting `pythonw.exe` with `LICENSE.txt` as argument. If not elevated, attempts UAC elevation via `ShellExecuteW` with the `runas` verb. 8. **Reconnaissance:** The RAT collects HWID (via `Get-CimInstance -Class Win32_ComputerSystemProduct.UUID`), RAM size (via `wmic memorychip get Capacity`), and installed AV (via `Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct`). For AD-joined hosts, it executes `whoami && systeminfo && net user {USERNAME} /dom && nltest /dclist`; for workgroup hosts, `whoami /all`. It captures a desktop screenshot as PNG, Base64-encodes it in memory, and deletes the PNG from disk. It enumerates 40+ cryptocurrency wallets (desktop and browser extension). 9. **Data staging and exfiltration:** All collected data is consolidated into a JSON file, XOR-encrypted with 5-byte key `helo1`, Base64-encoded, and sent to the primary C2 via HTTP POST with User-Agent `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36`. Before C2 registration, a Telegram notification is sent to bot "8384531459" containing the victim's public IP (sourced from `api64.ipify[.]org`), build name, region locale, computer name (as "Crew ID"), OS platform/release, processor string, and the hardcoded label "Windows Defender" as the protection indicator. Crypto wallet detections are appended. 10. **C2 communication:** The RAT polls the C2 every 50–60 seconds with a GET request containing minimal JSON with two randomly named junk fields and the bot's unique identifier, XOR-encrypted with key `helo1` and Base64-encoded. The C2 responds with one of five commands: `shellexecute` (runs arbitrary shell via `cmd /c` or PowerShell), `x32` (downloads and executes 32-bit shellcode via APC injection), `x64` (downloads and executes 64-bit shellcode via APC injection), `download` (downloads payload to `%TEMP%` and executes by extension — EXE, MSI, DLL, ZIP), or HTTP 403 (triggers self-deletion and process exit — kill switch). 11. **Blockchain-anchored C2 fallback:** If primary C2 registration fails, the RAT issues an `eth_call` via JSON-RPC to `polygon-rpc[.]com`, targeting smart contract `0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba` and function selector `0xc659f3b8` for the latest block. The returned encrypted hex string is XOR-decrypted with key `$m7*rYpry3` to recover a fallback C2 domain. 12. **WLDR C2 deployment:** The actor can execute a `curl` command via Starland RAT to download and execute the WLDR C2 PowerShell stager from a separate C2\. The stager is heavily obfuscated, establishes a loop counter and two boolean flags, and XOR-decrypts an embedded WLDR downloader using a dynamically computed key. 13. **WLDR downloader:** Derives HWID from the C: drive volume serial number (hexadecimal to decimal), appends it to two hardcoded C2 URLs, and issues HTTP GET. The C2 responds only to pre-registered HWIDs with an encrypted JSON envelope containing Base64-encoded salt, IV, encrypted data, and authentication tag. The downloader derives a 64-byte key from hardcoded password `odg5t8mvssvh` and the server-provided salt, decrypts the WLDR agent, and writes the C2 URL and password into the global PowerShell scope. 14. **WLDR agent execution:** The in-memory PowerShell agent checks for the globally scoped C2 URL and password, initializes a mutex `f2j398fj239d8j23dkkskskkkkkkkkk` to prevent duplicate instances, and establishes encrypted C2 communication using AES-256-CBC with HMAC-SHA256 (encrypt-then-MAC), with session keys derived via PBKDF2-SHA256 at 5,000 iterations. Protocol version tag `WSv1` is bound to every MAC computation. Initial connection via HTTP POST includes victim profile, infection identifier, protocol version `2.0.0`, and cryptographic session parameters. The agent polls every 10 seconds. C2 responses contain encrypted PowerShell commands/scripts executed via a RunspacePool (up to 10 concurrent threads) with real-time output streaming, or via PowerShell background jobs as fallback. 15. **Secondary payload delivery (shellcode loader):** The actor delivers CastleStealer via x64 shellcode and Remcos RAT via x32 shellcode. The custom shellcode loader resolves all Windows APIs at runtime via hash-based export enumeration, neutralizes AMSI (`AmsiScanBuffer` in `amsi.dll`) and ETW (`EtwEventWrite` in `ntdll.dll`) by patching their first bytes (with a `VirtualProtect` fallback), decrypts and LZX-decompresses the embedded payload, and dispatches it via reflective PE injection, .NET CLR loading through `ICorRuntimeHost` COM interface, or PowerShell Runspace. 16. **CastleStealer capabilities:** .NET infostealer targeting Chromium browser family and Firefox via direct SQLite database access (DPAPI and AES-GCM decryption), crypto wallet browser extensions, Discord and Telegram session files, Steam credentials, and targeted filesystem paths. Exfiltrates via TCP socket. Includes Russian locale exclusion check and hardcoded build expiry timestamp. Supports secondary payload delivery via process injection or PowerShell execution. ### Infrastructure summary - **Staging domains:** `eorthopaedics[.]com` (likely hijacked), `web-devtools[.]com`, `zynaris[.]io` - **Starland RAT primary C2:** `windowscreenrepairnearme[.]com` (likely hijacked), `aipythondevs[.]com` - **WLDR C2 / parallel infrastructure:** `eorthopaedics[.]com` (path `/feed/`), `sastoro[.]com` (path `/alpha/`) - **Shellcode payload hosting:** `web-devtools[.]com` (paths `/starlandfox`, `/x32remka`, `/dopfile`) - **Polygon smart contract:** `0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba` - **Telegram bots:** `8384531459` ("skuefq\_bot"), `7993597060` ("komandastuk\_bot") - **Telegram channel:** "stuk komanda" (created June 5, 2025; 3 subscribers; structured as C2 with binary filename messages) ## 4\. Mitigation & containment ### P1 — within 24 hours - Block the following domains at DNS/proxy/firewall: `eorthopaedics[.]com`, `web-devtools[.]com`, `zynaris[.]io`, `sastoro[.]com`, `windowscreenrepairnearme[.]com`, `aipythondevs[.]com`, `polygon-rpc[.]com` (assess business impact before blocking — legitimate Polygon RPC traffic may exist), `api64.ipify[.]org` (assess operational impact). - Deploy EDR detection rules for: `mshta.exe` executing remote URLs; `pythonw.exe` executing with `LICENSE.txt` as argument; scheduled task creation matching pattern `PythonLauncher-*`; registry persistence at `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` value `MyApp`; PowerShell `New-ScheduledTask` with `PythonLauncher-` prefix. - Block Telegram bot API traffic to bot IDs `8384531459` and `7993597060` if egress filtering to `api.telegram.org` is feasible. - Hunt for the WLDR agent mutex `f2j398fj239d8j23dkkskskkkkkkkkk` across endpoint memory. - Deploy the provided ClamAV signatures (listed in §6) and Snort SIDs 66787–66790 and 301580. ### P2 — within 72 hours - Audit all software download sources for MobaXterm, WebEx, Zoom, DBeaver Community Edition, and FACEIT across the estate — verify hashes against vendor-published values and remove any installers sourced from non-official domains. - Enable AMSI tamper detection in EDR; alert on memory patching of `AmsiScanBuffer` and `EtwEventWrite`. - Monitor for outbound HTTP POST requests with User-Agent `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36` to the listed C2 domains. - Monitor for JSON-RPC calls to Polygon RPC endpoints targeting function selector `0xc659f3b8` at contract `0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba`. - Review scheduled tasks across endpoints for names matching `PythonLauncher-{3 chars}` and LNK files in user Startup folders targeting `pythonw.exe`. ### P3 — within 7 days - Implement application allow-listing for `mshta.exe` and restrict execution to approved paths/signers. - Enforce software download policy: all installer executables must be sourced from vendor-verified portals with hash verification; block execution of installers from user-writable directories. - Conduct user awareness training on ClickFix social engineering tactics (fake verification prompts enticing users to run pasted commands). - Review and tighten egress filtering for PowerShell-based beaconing patterns: regular 10-second and 50–60 second HTTP polling intervals with encrypted payloads. - Deploy the YARA and Sigma rules in §6 to SIEM and EDR. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ---------------------- | --------------------------------------------------------------------------------------------------------------- | ---------------------------------- | ------ | | domain | eorthopaedics\[.\]com | High | Talos | | domain | web-devtools\[.\]com | High | Talos | | domain | zynaris\[.\]io | High | Talos | | domain | sastoro\[.\]com | High | Talos | | domain | windowscreenrepairnearme\[.\]com | High | Talos | | domain | aipythondevs\[.\]com | High | Talos | | domain | polygon-rpc\[.\]com | High | Talos | | domain | api64.ipify\[.\]org | Medium (legitimate service abused) | Talos | | smart-contract | 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba | High | Talos | | telegram-bot | 8384531459 (skuefq\_bot) | High | Talos | | telegram-bot | 7993597060 (komandastuk\_bot) | High | Talos | | mutex | f2j398fj239d8j23dkkskskkkkkkkkk | High | Talos | | registry-key | HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MyApp | High | Talos | | filepath | LICENSE.txt (executed as pythonw.exe argument) | High | Talos | | user-agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | High | Talos | | url-path | /starlandfox | High | Talos | | url-path | /x32remka | High | Talos | | url-path | /dopfile | High | Talos | | url-path | /feed/ | High | Talos | | url-path | /alpha/ | High | Talos | | xor-key | 0xC6 (198 decimal — Python loader) | High | Talos | | xor-key | helo1 (5-byte — Starland RAT data staging) | High | Talos | | xor-key | $m7\*rYpry3 (blockchain fallback domain decryption) | High | Talos | | password | odg5t8mvssvh (WLDR C2 session key) | High | Talos | | function-selector | 0xc659f3b8 (Polygon smart contract eth\_call) | High | Talos | | protocol-tag | WSv1 (WLDR agent MAC binding) | High | Talos | | protocol-version | 2.0.0 (WLDR agent initial connection) | High | Talos | | scheduled-task-pattern | PythonLauncher-{3 random characters} | High | Talos | | clamav-sig | Txt.Downloader.Agent-10060312-0 | High | Talos | | clamav-sig | Html.Downloader.Agent-10060313-0 | High | Talos | | clamav-sig | Html.Downloader.Agent-10060314-0 | High | Talos | | clamav-sig | Py.Loader.Agent-10060315-0 | High | Talos | | clamav-sig | Py.Loader.Agent-10060316-0 | High | Talos | | clamav-sig | Ps1.Trojan.Agent-10060317-0 | High | Talos | | clamav-sig | Ps1.Trojan.Agent-10060318-0 | High | Talos | | clamav-sig | Ps1.Trojan.WLDRAgent-10060319-0 | High | Talos | | clamav-sig | Ps1.Downloader.Agent-10060320-0 | High | Talos | | clamav-sig | Win.Trojan.CastleStealer-10060341-0 | High | Talos | | clamav-sig | Win.Trojan.Starland\_Installer-10060342-0 | High | Talos | | clamav-sig | Win.Malware.Starland-10060343-0 | High | Talos | | clamav-sig | Win.Malware.Remka-10060344-0 | High | Talos | | snort-sid | 66787–66790, 301580 | High | Talos | ```iocs domain eorthopaedics[.]com domain web-devtools[.]com domain zynaris[.]io domain sastoro[.]com domain windowscreenrepairnearme[.]com domain aipythondevs[.]com domain polygon-rpc[.]com domain api64.ipify[.]org smart-contract 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba telegram-bot 8384531459 telegram-bot 7993597060 mutex f2j398fj239d8j23dkkskskkkkkkkkk registry-key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp filepath LICENSE.txt user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 url-path /starlandfox url-path /x32remka url-path /dopfile url-path /feed/ url-path /alpha/ xor-key 0xC6 xor-key helo1 xor-key $m7*rYpry3 password odg5t8mvssvh function-selector 0xc659f3b8 protocol-tag WSv1 protocol-version 2.0.0 scheduled-task-pattern PythonLauncher- clamav-sig Txt.Downloader.Agent-10060312-0 clamav-sig Html.Downloader.Agent-10060313-0 clamav-sig Html.Downloader.Agent-10060314-0 clamav-sig Py.Loader.Agent-10060315-0 clamav-sig Py.Loader.Agent-10060316-0 clamav-sig Ps1.Trojan.Agent-10060317-0 clamav-sig Ps1.Trojan.Agent-10060318-0 clamav-sig Ps1.Trojan.WLDRAgent-10060319-0 clamav-sig Ps1.Downloader.Agent-10060320-0 clamav-sig Win.Trojan.CastleStealer-10060341-0 clamav-sig Win.Trojan.Starland_Installer-10060342-0 clamav-sig Win.Malware.Starland-10060343-0 clamav-sig Win.Malware.Remka-10060344-0 snort-sid 66787 snort-sid 66788 snort-sid 66789 snort-sid 66790 snort-sid 301580 ``` ## 6\. Detection ```yara rule Starland_RAT_Python_Loader { meta: author = "Adverse Trace" date = "2026-07-17" reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/" description = "Detects Starland RAT Python loader disguised as LICENSE.txt" strings: $filename = "LICENSE.txt" ascii $runtime = "pythonw.exe" ascii $xor_key = { C6 } $api1 = "VirtualAllocEx" ascii $api2 = "WriteProcessMemory" ascii $api3 = "CreateRemoteThread" ascii $api4 = "VirtualProtectEx" ascii $api5 = "CreateProcessA" ascii $api6 = "QueueUserAPC" ascii $api7 = "ResumeThread" ascii $dll = "kernel32.dll" ascii $sandbox1 = "WDAGUtilityAccount" ascii $sandbox2 = "Cuckoo" ascii $sandbox3 = "Any.Run" ascii $sandbox4 = "Joe Sandbox" ascii $sandbox5 = "Hybrid Analysis" ascii $xor_data_key = "helo1" ascii $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" ascii $contract = "0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba" ascii $func_selector = "0xc659f3b8" ascii $fallback_key = "$m7*rYpry3" ascii $ipify = "api64.ipify" ascii $label = "Windows Defender" ascii $crew = "Crew ID" ascii condition: $filename and $runtime and ($api1 or $api2 or $api3 or $api4 or $api5 or $api6 or $api7) and $dll and ($sandbox1 or $sandbox2 or $sandbox3 or $sandbox4 or $sandbox5) and $xor_data_key } rule WLDR_Agent_PowerShell { meta: author = "Adverse Trace" date = "2026-07-17" reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/" description = "Detects WLDR C2 PowerShell agent strings" strings: $mutex = "f2j398fj239d8j23dkkskskkkkkkkkk" ascii $password = "odg5t8mvssvh" ascii $proto_tag = "WSv1" ascii $proto_ver = "2.0.0" ascii $wldr = "WLDR" ascii condition: $mutex and ($password or $proto_tag or $proto_ver) and $wldr } rule CastleStealer_DotNet { meta: author = "Adverse Trace" date = "2026-07-17" reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/" description = "Detects CastleStealer .NET implant indicators" strings: $amsi = "AmsiScanBuffer" ascii $etw = "EtwEventWrite" ascii $amsi_dll = "amsi.dll" ascii $ntdll = "ntdll.dll" ascii $clr = "ICorRuntimeHost" ascii condition: ($amsi and $amsi_dll) and ($etw and $ntdll) and $clr } ``` ```yaml title: UAT-11795 Starland RAT Persistence and Execution id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b3d5e8f12 status: experimental description: Detects Starland RAT persistence mechanisms and WLDR agent mutex author: Adverse Trace date: 2026/07/17 references: - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ logsource: product: windows category: process_creation detection: selection_mshta_run_key: EventID: 1 Image|endswith: '\mshta.exe' CommandLine|contains: - 'http' - '.hta' selection_pythonw_license: EventID: 1 Image|endswith: '\pythonw.exe' CommandLine|contains: 'LICENSE.txt' selection_scheduled_task: EventID: 1 Image|endswith: '\powershell.exe' CommandLine|contains|all: - 'New-ScheduledTask' - 'PythonLauncher-' selection_run_key_myapp: EventID: 13 TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp' selection_curl_wldr: EventID: 1 Image|endswith: '\curl.exe' CommandLine|contains: - 'powershell' - '.ps1' condition: selection_mshta_run_key or selection_pythonw_license or selection_scheduled_task or selection_run_key_myapp or selection_curl_wldr falsepositives: - Legitimate use of mshta.exe for internal HTA applications (unlikely in enterprise) - Python projects with a LICENSE.txt argument (rare) level: high ``` ```yaml title: UAT-11795 WLDR Agent Mutex Created id: 8b4d2g3f-5c6e-4b9f-0d2g-1b7c4e6f9a23 status: experimental description: Detects WLDR agent mutex creation indicating in-memory PowerShell C2 implant author: Adverse Trace date: 2026/07/17 references: - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ logsource: product: windows category: create_mutex detection: selection: EventID: 17 TargetFilename: 'f2j398fj239d8j23dkkskskkkkkkkkk' condition: selection falsepositives: - Unknown level: critical ``` ## 7\. Sources - Cisco Talos, "UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign," https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/, 2026-07-16 - BleepingComputer, "Russian hackers trojanize WebEx, Zoom apps to push Starland malware," https://www.bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/, 2026-07-16 - Cisco Talos, "Begun, the Patch Wars have," https://blog.talosintelligence.com/begun-the-patch-wars-have/, 2026-07-16 ## 8\. Adverse Trace position This is a high-severity opportunistic campaign with direct relevance to EMEA financial services organisations. The attack chain does not require exploitation of a specific CVE — it relies on social engineering (ClickFix) and trojanized legitimate software, making patch posture irrelevant to initial compromise. The in-memory execution of both Starland RAT (Python) and WLDR agent (PowerShell), combined with AMSI/ETW bypasses and blockchain-anchored C2 fallback, makes detection challenging for signature-based controls. The targeting of IT administration utilities (MobaXterm) and database tools (DBeaver) increases the likelihood of compromise reaching privileged users with access to sensitive financial systems. Attribution to UAT-11795 is unconfirmed (no MITRE ATT&CK profile); all technical detail is single-sourced from Talos — verify IOCs before enforcement at scale. We will monitor for additional IOCs from Talos's GitHub repository, assess whether any EMEA financial services clients have observed DNS resolution of the listed C2 domains, and update this advisory if the campaign expands beyond the currently observed victimology. --- [Read the original source →](https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*