Cisco Talos Identifies Russian-Speaking Threat Actor UAT-11795 Deploying Starland RAT and WLDR Agent in Global Financial Cyberattacks
Cisco Talos researchers have identified a sophisticated Russian-speaking threat actor, designated as UAT-11795, which has been conducting a series of aggressive cyber campaigns targeting organizations and individuals across the United States and Europe. Active since at least June 2023, this group focuses on financial gain, specifically targeting sensitive credentials and cryptocurrency assets. The campaign is notable for its use of trojanized installers for ubiquitous professional and consumer software, including Zoom, WebEx, MobaXterm, DBeaver, and FaceIT. By embedding malicious components within legitimate tools that remote and hybrid workers rely on daily, UAT-11795 has successfully bypassed traditional perimeter defenses, exploiting human trust rather than technical software vulnerabilities.
The discovery of UAT-11795 highlights an evolving trend in the cyber threat landscape where attackers prioritize "living-off-the-land" techniques and social engineering over zero-day exploits. The group’s toolkit includes two previously undocumented pieces of malware: a Python-based remote access trojan (RAT) dubbed Starland RAT and a PowerShell-based memory implant known as the WLDR agent. These tools, combined with a resilient command-and-control (C2) infrastructure that utilizes both Telegram and the Polygon blockchain, represent a significant threat to global digital asset security and corporate data integrity.
The Social Engineering Pipeline: From ClickFix to Compromise
The initial infection vector employed by UAT-11795 relies heavily on a social engineering technique known as "ClickFix." This method involves presenting a victim with a deceptive web page or pop-up—often mimicking a browser update or a technical error message—that instructs the user to copy and execute a specific command in their terminal or PowerShell environment to "fix" the issue. This approach is particularly effective because it circumvents automated browser security warnings and relies on the user to manually authorize the execution of malicious code.
Once the user executes the command, a remotely hosted, weaponized HTML Application (HTA) file is downloaded and executed. This HTA file contains an embedded VBScript that drops a Windows batch file into the user profile’s temporary application folder. This batch file serves as the primary downloader, reaching out to an attacker-controlled staging domain to pull down and install a trojanized version of a legitimate software installer.
By providing a fully functional, albeit compromised, version of software like Zoom or MobaXterm, the attackers maintain a veneer of legitimacy. The user believes they have successfully installed the tool they needed, while in the background, the malicious payloads are silently deployed to establish persistence and begin the data exfiltration process.
Technical Anatomy of Starland RAT and WLDR Agent
The primary objective of UAT-11795 is the deployment of the Starland RAT and the WLDR agent, both of which are designed to grant the attackers comprehensive control over the victim’s machine.
Starland RAT is a Python-based remote access tool that provides a wide array of surveillance and data theft capabilities. Once active, it can log keystrokes, capture screenshots, and harvest saved credentials from various web browsers. More importantly, given the group’s financial motivations, Starland RAT is specifically programmed to scan the system for cryptocurrency wallet files and browser extensions. By gaining access to these assets, the threat actors can facilitate the unauthorized transfer of digital currencies directly from the victim’s accounts.
Complementing the Starland RAT is the WLDR agent, a sophisticated PowerShell-based C2 memory implant. Unlike traditional malware that resides on the hard drive, the WLDR agent operates entirely within the system’s RAM. This "fileless" approach makes it exceptionally difficult for standard antivirus and endpoint detection and response (EDR) solutions to detect, as there is no malicious executable file to scan on the disk.
The WLDR agent features several advanced capabilities, including:
- Encrypted Beaconing: Communication with the C2 server is encrypted to hide the nature of the traffic from network monitoring tools.
- Task Queuing: The agent can receive and queue multiple commands from the attackers, executing them sequentially.
- Runspace Execution Engine: This allows the agent to execute additional payloads or scripts within a separate PowerShell environment, further isolating the malicious activity from the main system processes.
Innovative Infrastructure: Blockchain and Telegram
A defining characteristic of UAT-11795 is the resilience and redundancy of its command-and-control infrastructure. Cisco Talos researchers discovered that the group utilizes a private Telegram channel, named "stuk komanda," created in June 2023. This channel likely serves as a real-time notification system for successful infections or as a simplified exfiltration point for stolen data.
Perhaps more striking is the group’s use of the Polygon blockchain. UAT-11795 has been observed hiding a fallback C2 channel within a Polygon smart contract. By leveraging decentralized blockchain technology, the attackers ensure that even if their primary domains or servers are taken down by law enforcement or hosting providers, the infected machines can still receive instructions by querying the immutable smart contract. This "bulletproof" hosting strategy demonstrates a high level of technical sophistication and a long-term commitment to maintaining their malicious operations.
Chronology of Activity and Geographical Distribution
The activity of UAT-11795 can be traced back to the summer of 2023, with a marked increase in campaign intensity throughout 2024. The group appears to be highly organized, systematically updating their malicious installers to include the latest versions of the legitimate software they spoof.
While the primary targets are located within the United States, Cisco Talos has documented successful infections in several other countries, including:
- Germany: Targeting European corporate hubs.
- Romania: Often used as a gateway for broader European campaigns.
- Venezuela: Highlighting the group’s willingness to target regions with volatile financial environments where cryptocurrency adoption is high.
The timeline suggests that UAT-11795 is not a fly-by-night operation but a persistent threat actor that continuously refines its methods. The use of Russian-language artifacts within their code and communication channels strongly suggests the group originates from a Russian-speaking region, though their targets remain global.
Industry Response and Expert Analysis
The cybersecurity community has reacted with concern to the emergence of UAT-11795, particularly regarding the group’s ability to exploit trusted software environments. Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, noted that this campaign targets the very foundations of the modern workspace.
"By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities," Patel stated. He emphasized that the reliance on remote work tools has created a massive, decentralized attack surface that is difficult for centralized IT departments to fully secure.
Gabrielle Hempel, a security operations strategist at Exabeam, suggested that this campaign necessitates a fundamental shift in how organizations approach vulnerability management. "We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems," Hempel explained.
Hempel argued that the industry must move toward "provenance management"—the ability to verify exactly where a binary or installer originated. "If your security program can’t answer ‘where did this binary come from?’ as quickly as it can answer ‘is this CVE patched?’ then you are behind on your threat model," she added.
Broader Impact and Defensive Recommendations
The emergence of UAT-11795 signifies a broader trend in cybercrime where financially motivated actors are adopting the tactics, techniques, and procedures (TTPs) typically associated with state-sponsored advanced persistent threats (APTs). The use of fileless implants and blockchain-based C2 infrastructure indicates a professionalization of the cybercriminal underground.
For organizations and individual users, the implications are clear: technical defenses alone are insufficient. A multi-layered approach to security is required, focusing on both technical controls and user education.
Defensive recommendations include:
- Software Provenance Verification: Users should only download software from official, verified websites. Organizations should implement strict application whitelisting and use tools that can verify the digital signatures of all installers.
- User Awareness Training: Employees must be educated on the "ClickFix" technique and other social engineering tactics. The instruction to copy-paste commands into a terminal should be treated as a major red flag.
- Enhanced Endpoint Monitoring: Because the WLDR agent operates in-memory, organizations need advanced EDR solutions capable of monitoring PowerShell activity and memory-based anomalies in real-time.
- Network Segmentation: Restricting the ability of workstations to communicate with unauthorized domains or blockchain nodes can help disrupt the C2 lifecycle.
- Multi-Factor Authentication (MFA): While UAT-11795 targets credentials, robust MFA can prevent attackers from using stolen passwords to access sensitive corporate systems or financial accounts.
As UAT-11795 continues to evolve, the cybersecurity industry must remain vigilant. The group’s focus on the human element of security highlights a critical vulnerability in the digital age: the assumption that a "signed" or "legitimate-looking" program is inherently safe. In the current threat landscape, trust must be earned through verification, not assumed through branding.
Related posts:
