UAT-11795 Uses Trojanized Software Installers to Deploy Starland RAT
Summary
Cisco Talos reports that UAT-11795 has used trojanized installers since at least June 2025 to deploy Starland RAT, steal sensitive data, and deliver CastleStealer or Remcos. The infection vector is unconfirmed; ClickFix is a suspected possibility.
Key points
- Cisco Talos reports attacks since at least June 2025, primarily targeting U.S. users, with victims also observed in Germany, Romania, and Venezuela.
- Trojanized installers for MobaXterm, WebEx, Zoom, DBeaver, and FaceIT are used to deliver an HTA file and a trojanized NSIS installer containing a Python loader.
- The loader establishes persistence through Windows Registry changes and loads Starland RAT; the malware also uses scheduled tasks and Startup folder items.
- Starland RAT collects browser and cryptocurrency wallet data, system details, and Active Directory information, and can capture screenshots, run shell commands, and load additional payloads.
- Observed payload chains deliver CastleStealer through 64-bit shellcode and Remcos RAT through 32-bit shellcode.
- Talos says the actor uses a previously undocumented, in-memory PowerShell C2 framework called WLDR, with encrypted communications and payload delivery tied to a victim’s hardware identifier.
- The initial infection vector is not confirmed; researchers speculate that malicious files may be distributed using ClickFix. Users are advised to download software from official vendor portals and avoid running unexplained commands.
Article Details
- Attack Vectors
- Trojanized installers for MobaXterm, WebEx, Zoom, DBeaver, and FaceIT deliver a Python loader disguised as LICENSE.txt, which decrypts and loads Starland RAT.
- The observed chain starts with an HTA file that retrieves a trojanized NSIS installer.
- Cisco Talos could not confirm the infection vector; researchers speculated that malicious files may be distributed using ClickFix.
- Starland RAT can download additional EXE, MSI, DLL, and ZIP payloads; observed 64-bit and 32-bit shellcode chains delivered CastleStealer and Remcos RAT, respectively.
- Defensive Notes
- Download software only from confirmed official vendor portals.
- Avoid executing commands found online unless you understand what they do.
- Organizations should use the indicators of compromise in the Cisco Talos report.
MITRE ATT&CK
T1005 · Data from Local SystemStarland and CastleStealer collect data from compromised systems, including browser data, wallet information, and filesystem files.T1053.005 · Scheduled TaskStarland RAT adds scheduled tasks for persistence.T1056.001 · KeyloggingRemcos RAT provides keylogging capabilities.T1059.001 · PowerShellThe previously undocumented WLDR C2 framework is implemented in PowerShell.T1059.003 · Windows Command ShellStarland RAT can execute shell commands.T1105 · Ingress Tool TransferThe HTA retrieves a trojanized installer, and Starland RAT can download additional payloads.T1112 · Modify RegistryThe Python loader modifies the Windows Registry to establish persistence.T1113 · Screen CaptureStarland can capture screenshots, and Remcos RAT can capture the victim's screen.T1115 · Clipboard DataRemcos RAT monitors clipboard contents.T1497.001 · System ChecksStarland checks whether it is running in a sandbox environment.T1547.001 · Registry Run Keys / Startup FolderStarland RAT adds items to the Startup folder for persistence.T1555.003 · Credentials from Web BrowsersCastleStealer targets browser credentials.T1573 · Encrypted ChannelWLDR uses encrypted beaconing and communications, and Starland's fallback C2 domain is XOR-encrypted.
Threat Actors
Malware
CastleStealer#UAT-11795Remcos RATThe attack chain can also deliver CastleStealer and Remcos RAT for additional credential theft and remote control.Starland RATUAT-11795 is a financially motivated Russian threat actor using trojanized installers to deploy Starland RAT and steal credentials, cryptocurrency wallet data, and other sensitive information from victims.
Products
Tools
Countries
Germanyusers primarily targeted and additional victims seen in Germany, Romania, and Venezuela.Romaniausers primarily targeted and additional victims seen in Germany, Romania, and Venezuela.United StatesCisco Talos reported attacks since June 2025, with U.S.Venezuelausers primarily targeted and additional victims seen in Germany, Romania, and Venezuela.