Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe
Do Son 
At a glance
| Actor / group | UAT-11795 (suspected Russian-speaking, financially motivated) |
| Activity type | Credential and cryptocurrency theft via trojanized software installers |
| Targets / victims | Windows users in the U.S. and parts of Europe; crypto holders in particular |
| Scale | Active since at least June 2025; U.S. most affected, plus Germany, Romania, and Venezuela |
| Law-enforcement status | No arrests or charges reported. Talos tracks the actor under a temporary UAT designation. |
| Source | Cisco Talos |
TL;DR
Cisco Talos disclosed a new malware family called Starland RAT on July 16, 2026. A Russian-speaking actor tracked as UAT-11795 uses it to steal credentials and drain cryptocurrency wallets. The campaign hides trojanized malware inside fake installers for Zoom, WebEx, and other trusted tools.
What happened
Talos found a financially motivated group pushing weaponized software installers. Victims think they are downloading MobaXterm, Cisco WebEx, Zoom, DBeaver, or FaceIT. Instead, they get Starland RAT.
According to Talos, the actor “delivers a Python-based remote access tool” that runs in memory. The breadth of lures points to a volume-driven model. In other words, the group casts a wide net rather than targeting one industry.
How the infection works
The chain likely starts with a ClickFix lure. Talos could not confirm the first step, so it flags this as an assessment. A fake HTA file then runs through mshta.exe and pulls a trojanized installer.
That installer hides a Python loader named LICENSE.txt. The loader decrypts Starland RAT and runs it in memory. Persistence follows through a scheduled task and a startup shortcut.
What Starland RAT steals
Starland RAT hunts money and access. It scans for more than 40 cryptocurrency wallets across browser extensions and desktop apps. It also grabs browser credentials, takes a screenshot, and profiles the host.
The RAT then acts as a gateway. It can run shell commands, inject 32-bit or 64-bit shellcode, or download more files. A 64-bit path drops CastleStealer, while a 32-bit path drops Remcos RAT.
The WLDR agent and hidden C2
One tool stands out. The WLDR agent is a PowerShell backdoor that lives only in memory. It uses encrypted beaconing and a Runspace engine that runs tasks across up to ten threads. As a result, an operator gets interactive, streaming control of the machine.
The infrastructure shows care. All C2 URLs bind to a victim hardware ID from the C: drive serial number. Two Telegram bots receive victim fingerprints and wallet inventories. The actor even stashed a fallback C2 domain inside a Polygon smart contract, which the malware reads through a public blockchain call.
Who is behind it
Attribution stays at the cluster level. Talos tracks the group as UAT-11795 and calls it Russian-speaking and financially motivated. That language assessment rests on a Russian-language developer comment left in the code. No named individuals, no charges, and no arrests have been reported.
Impact and scale
Talos bases victim numbers on its own telemetry and passive DNS. The United States shows the heaviest infection rate. Germany, Romania, and Venezuela follow at lower levels. A private Telegram channel named “stuk komanda”, created on June 5, 2025, suggests the operation has run for over a year.
How to stay protected
The fix is mostly about habits. Never paste a command from a web page into a terminal. Download software only from official vendor sites, not search ads or random links.
Defenders have concrete signals to hunt. Watch for mshta.exe spawning downloads, PowerShell scheduled tasks with random names, and traffic to Telegram’s API. Talos published full indicators, ClamAV signatures, and Snort rules in its report, so security teams can deploy detection today.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
