Cisco Talos Identifies UAT-11795 Russian Threat Actor Deploying Starland RAT and WLDR Agent in High Volume Financial Campaigns

Cybersecurity researchers at Cisco Talos have identified a sophisticated and highly active Russian-speaking threat actor, currently tracked as UAT-11795, which has been conducting a relentless campaign against organizations and individuals across the United States and Europe. Active since at least June 2023, this group specializes in a blend of social engineering and technical evasion to deploy a suite of previously undocumented malware. The primary objectives of the campaign appear to be the theft of sensitive credentials and the exfiltration of cryptocurrency assets, marking it as a significant financially motivated threat in the current landscape.

The group’s methodology relies on exploiting the trust users place in ubiquitous professional software. By utilizing trojanized installers for legitimate tools such as Zoom, Cisco WebEx, MobaXterm, DBeaver, and the gaming platform FaceIT, UAT-11795 effectively bypasses many traditional perimeter defenses. These tools are staples of the modern remote and hybrid workforce, making them ideal vehicles for delivery. Once a victim is compromised, the threat actor deploys two custom-built tools: a Python-based remote access trojan (RAT) dubbed Starland RAT and a PowerShell-based memory implant known as WLDR agent.

The Evolution of the ClickFix Social Engineering Technique

UAT-11795 does not typically rely on traditional zero-day vulnerabilities in software. Instead, it leverages the "ClickFix" social engineering tactic, a method that has gained significant traction among cybercriminal groups over the last year. This technique involves presenting the user with a deceptive popup or overlay that mimics a legitimate system error or a browser update requirement. Often, these prompts claim that a document cannot be displayed or that a browser component is missing, providing the user with a "Fix" button or a command to copy and paste into a terminal.

When a victim follows these instructions, they unwittingly execute a malicious command that initiates the infection chain. In the case of UAT-11795, this command triggers the download and execution of a remotely hosted, weaponized HTML Application (HTA) file. This HTA file contains embedded VBScript, which serves as the primary stage of the infection. The script is designed to drop a Windows batch file into the user profile’s temporary application folder. This batch file then proceeds to download and install the trojanized version of the legitimate software the user was originally seeking or expected to use.

This approach is particularly effective because it targets human psychology rather than software flaws. By creating a sense of urgency or a need to "fix" a technical hurdle, the attackers convince the user to lower their guard and bypass security warnings. Because the final payload is often wrapped inside a legitimate, signed installer, many endpoint detection and response (EDR) systems may fail to flag the initial installation as malicious.

Technical Analysis of Starland RAT and WLDR Agent

The core of UAT-11795’s post-exploitation capability lies in its bespoke malware. The first of these, Starland RAT, is a Python-based tool designed for persistent access and data exfiltration. As a remote access trojan, it allows the attackers to maintain a foothold on the victim’s machine, monitor user activity, and execute arbitrary commands. Python-based malware has become increasingly popular among threat actors due to its ease of development and the ability to package it into standalone executables that can run on Windows without a pre-installed Python environment.

The second tool, WLDR agent, represents a higher level of technical sophistication. WLDR is a PowerShell-based Command and Control (C2) memory implant. Unlike traditional malware that resides on the hard drive, WLDR runs entirely in the system’s volatile memory (RAM). This "fileless" approach makes it significantly harder for traditional antivirus software to detect, as there is no malicious file on the disk to scan.

WLDR agent features several advanced capabilities:

• Encrypted Beaconing: The agent communicates with the attacker’s C2 server using encrypted channels to avoid detection by network security monitors.
• Task Queuing: It can receive and queue multiple tasks from the attackers, executing them sequentially or based on specific triggers.
• Runspace Execution Engine: WLDR utilizes PowerShell Runspaces to execute additional payloads or scripts in a way that is isolated from the main PowerShell process, further complicating forensic analysis.

By combining the persistent access of Starland RAT with the stealthy, in-memory execution of WLDR, UAT-11795 creates a robust environment for long-term espionage and financial theft.

Blockchain-Based Evasion: The Polygon Smart Contract Fallback

One of the most notable features of UAT-11795’s infrastructure is its use of decentralized technology for command and control. Cisco Talos discovered that the group utilizes a fallback C2 channel hidden within a smart contract on the Polygon blockchain.

In a typical malware infection, the malware attempts to contact a hardcoded IP address or domain name. If defenders block these addresses, the malware loses contact with its operators. To counter this, UAT-11795 uses the blockchain as a "dead drop resolver." The malware is programmed to query a specific smart contract on the Polygon network. The smart contract contains the current, active IP address of the attackers’ C2 server.

Because the blockchain is decentralized and immutable, it is nearly impossible for law enforcement or security researchers to "take down" or censor the information contained within the smart contract. This ensures that even if the primary C2 infrastructure is dismantled, the infected machines can simply check the blockchain to find the new location of their controllers. This technique demonstrates a high level of operational security and a forward-thinking approach to infrastructure resilience.

Chronology and Geographical Reach

The activities of UAT-11795 were first noted by researchers in June 2023. At that time, the group began establishing its infrastructure, including the creation of a private Telegram channel titled "stuk komanda" (translated from Russian as "knock command" or "thump team"). This channel appears to serve as a notification hub or a collaborative space for the group’s operators, though it remains tightly controlled with a minimal number of subscribers.

Over the past year, the campaign has expanded its geographical footprint. While the majority of infections have been identified within the United States, Cisco Talos has documented successful compromises in Germany, Romania, and Venezuela. The diversity of the targets suggests that the group is not necessarily targeting specific industries but is instead casting a wide net to capture high-value credentials and cryptocurrency wallets regardless of the victim’s sector.

The timeline of the attacks shows a consistent pattern of infrastructure rotation. The group frequently updates its staging domains and modifies the code of its trojanized installers to evade signature-based detection. This constant evolution suggests a well-funded or highly motivated group with the resources to maintain a long-term campaign.

Industry Reactions and Expert Commentary

Cybersecurity experts have expressed concern over the methods employed by UAT-11795, particularly the focus on exploiting tools that are essential for the modern workplace. Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, noted that the campaign is part of a broader trend where attackers weaponize the very software that remote workers rely on to be productive.

"By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities," Patel stated. He emphasized that as organizations move away from traditional office environments, the "human perimeter" becomes the primary target for sophisticated actors.

Gabrielle Hempel, a security operations strategist at Exabeam, highlighted that this campaign necessitates a shift in how organizations approach vulnerability management. "We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems," Hempel observed.

She argued that the ability to verify the origin and integrity of a binary is now just as critical as patching known vulnerabilities (CVEs). "If your security program can’t answer ‘where did this binary come from?’ as quickly as it can answer ‘is this CVE patched?’ then you are behind on your threat model," Hempel added.

Analysis of Implications and Future Outlook

The emergence of UAT-11795 underscores several critical shifts in the cyber threat landscape. First, the move toward "fileless" and memory-resident malware like the WLDR agent indicates that attackers are increasingly prioritizing stealth and anti-forensic techniques. This places a premium on advanced endpoint detection and response (EDR) solutions that can monitor behavioral patterns in memory rather than just static files on a disk.

Second, the use of blockchain technology for C2 resilience highlights the growing intersection between decentralized finance (DeFi) tools and cybercrime. As more threat actors adopt these methods, the traditional "whack-a-mole" strategy of blocking domains and IP addresses will become less effective. Security professionals will need to develop new ways to monitor blockchain interactions for signs of malicious activity.

Finally, the targeting of cryptocurrency assets suggests that Russian-speaking groups remain heavily focused on direct financial gain. While state-sponsored espionage often dominates headlines, the financial impact of groups like UAT-11795 on the private sector is immense. The theft of credentials also provides these actors with "keys to the kingdom," allowing them to sell access to other criminal groups or facilitate larger-scale ransomware attacks in the future.

To mitigate the risks posed by UAT-11795, organizations are advised to implement strict application whitelisting, enforce multi-factor authentication (MFA) across all corporate accounts, and conduct regular social engineering awareness training. Furthermore, IT departments should ensure that software is only downloaded from official, verified sources and that all installers are subjected to rigorous integrity checks before being deployed across the network. As threat actors continue to refine their psychological and technical tactics, the defense must become equally multifaceted, moving beyond simple patching to a holistic model of identity and binary verification.