Cisco sounds alarm over new Russian malware campaign hitting firms in US and Europe

Cisco Talos has identified a previously undocumented Russian-speaking threat actor, currently tracked as UAT-11795, which has been aggressively targeting organizations and individuals across the United States and Europe since at least June 2023. This cybercriminal collective employs a sophisticated combination of social engineering, trojanized installers for legitimate productivity software, and bespoke malware designed to exfiltrate sensitive credentials and drain cryptocurrency assets. The campaign is notable for its use of highly specialized tools, including the "Starland" Remote Access Trojan (RAT) and the "WLDR" memory implant, alongside a resilient command-and-control (C2) infrastructure that leverages blockchain technology to ensure persistent access to compromised systems.

The emergence of UAT-11795 highlights a continuing shift in the threat landscape, where attackers increasingly bypass traditional perimeter defenses by exploiting human psychology rather than technical software vulnerabilities. By masquerading as essential business tools such as Zoom, Cisco WebEx, and MobaXterm, the group manages to embed itself within the daily workflows of remote and hybrid employees. The financial motivation behind the campaign is evident in the group’s focus on cryptocurrency wallets and browser-stored credentials, suggesting a lucrative operation that seeks both immediate theft and long-term surveillance.

The Evolution of the UAT-11795 Campaign

The operational history of UAT-11795 dates back to mid-2023, with Cisco Talos researchers tracing the first signs of activity to June of that year. Since its inception, the group has refined its delivery methods and expanded its malware arsenal. While early efforts may have relied on more traditional phishing techniques, the group’s current methodology focuses on the "ClickFix" social engineering tactic. This approach involves presenting users with a fraudulent technical issue—such as a missing font or a browser error—and providing a "fix" that requires the user to execute a command in their system terminal.

By the end of 2023 and into early 2024, the group’s geographic footprint expanded significantly. While the United States remains the primary target, researchers have documented successful infections in Germany, Romania, and Venezuela. The diversity of the software being spoofed—ranging from database management tools like DBeaver to gaming platforms like FaceIT—indicates that UAT-11795 is casting a wide net, targeting IT professionals, administrative staff, and individual cryptocurrency holders alike.

Tactical Analysis: The "ClickFix" Infection Vector

The primary entry point for UAT-11795 is a deceptive technique known as ClickFix. This method relies on the victim visiting a compromised or malicious website that displays a pop-up alert claiming a software error has occurred. The alert typically instructs the user to click a button to "copy the fix" and then paste it into a Windows PowerShell or Command Prompt window. This action effectively tricks the user into manually executing a malicious script that bypasses the security warnings typically associated with downloading and running executable files.

Once the command is executed, it triggers a chain of events:

1. HTA Execution: The command downloads and runs a remotely hosted, weaponized HTML Application (HTA) file.
2. VBScript Deployment: The HTA file executes an embedded VBScript, which drops a Windows batch file into the user profile’s temporary application folder.
3. Trojanized Installer: The batch file downloads a trojanized version of a legitimate software installer from an attacker-controlled staging domain. These installers are often for popular tools such as MobaXterm, WebEx, Zoom, or DBeaver.
4. Malware Implantation: While the user believes they are installing a standard application, the installer silently deploys the Starland RAT and the WLDR agent in the background.

Technical Deep Dive: Starland RAT and WLDR Agent

The hallmark of UAT-11795’s technical capability lies in its two proprietary tools. The first, Starland RAT, is a Python-based remote access tool designed for comprehensive data theft. Starland is engineered to scan the victim’s machine for sensitive information, specifically targeting browser cookies, saved passwords, and cryptocurrency wallet extensions. It supports the exfiltration of data from popular wallets such as MetaMask, Phantom, and Coinbase Wallet. Beyond theft, Starland provides the attackers with a persistent backdoor, allowing them to execute remote commands, capture screenshots, and log keystrokes.

The second tool, the WLDR agent, is a sophisticated PowerShell-based C2 memory implant. Unlike traditional malware that resides on the hard drive, WLDR runs entirely in the system’s RAM (random-access memory), making it significantly harder for traditional antivirus and Endpoint Detection and Response (EDR) solutions to detect. WLDR features:

• Encrypted Beaconing: Communication between the infected machine and the C2 server is encrypted to prevent network traffic analysis from flagging the activity.
• Task Queuing: The implant can receive a list of tasks from the server and execute them sequentially.
• Runspace Execution: It utilizes a Runspace execution engine to run additional payloads without spawning new processes, further aiding in evasion.

Blockchain-Based Persistence and C2 Infrastructure

In a move that demonstrates a high level of operational maturity, UAT-11795 has integrated blockchain technology into its command-and-control infrastructure. Cisco Talos discovered that the group utilizes a smart contract on the Polygon (MATIC) network as a fallback C2 channel. By storing the IP address or domain of their primary C2 server within the decentralized ledger of the Polygon blockchain, the attackers ensure that even if their primary domains are taken down by law enforcement or internet service providers, the infected bots can "call home" to the blockchain to find the new location of the control server.

This "bulletproof" hosting strategy makes the campaign exceptionally resilient. Traditional takedowns involve seizing servers or blacklisting domains; however, a smart contract on a public blockchain cannot be easily deleted or altered by a third party. This ensures that the attackers maintain a persistent connection to their victims’ machines, allowing for the potential delivery of even more destructive payloads, such as ransomware, at a later date.

Additionally, researchers identified a private Telegram channel named "stuk komanda" (meaning "knock command" or "knock team" in Russian). This channel, created in June 2023, appears to serve as a notification hub or a coordination center for the group’s activities, further confirming the Russian-speaking origin of the threat actor.

Expert Reactions and the Shift in Vulnerability Management

Cybersecurity experts have expressed concern over the success of UAT-11795’s psychological tactics. Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, noted that the campaign specifically exploits the tools that the modern workforce depends on. "By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities," Patel stated. He emphasized that the reliance on hybrid and remote work has created a larger attack surface where users are more likely to trust digital prompts.

Gabrielle Hempel, a security operations strategist at Exabeam, pointed out that the campaign challenges traditional views on vulnerability management. "We often measure a program’s security maturity by patch SLAs (Service Level Agreements), but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems," Hempel observed. She argued that the ability to verify the origin and integrity of a binary is now just as critical as patching known CVEs (Common Vulnerabilities and Exposures). "If your security program can’t answer ‘where did this binary come from?’ as quickly as it can answer ‘is this CVE patched?’ then you are behind on your threat model," she added.

Implications for Corporate and Individual Security

The activities of UAT-11795 represent a dual threat to both organizational integrity and individual financial security. For corporations, the presence of a tool like Starland RAT or WLDR agent on an employee’s machine can lead to the compromise of corporate credentials, which can then be used for lateral movement within the network or for Business Email Compromise (BEC) attacks. For individuals, the focus on cryptocurrency wallets represents a direct and often irreversible financial loss.

The use of "signed installers"—which may appear legitimate because they carry a digital signature—further complicates the defense. Users have long been taught that a signed installer is a mark of safety; however, UAT-11795 demonstrates that attackers can obtain or forge signatures to give their malicious packages a veneer of authenticity.

Recommendations and Defensive Strategies

To defend against UAT-11795 and similar threat actors, cybersecurity organizations recommend a multi-layered approach that prioritizes user education alongside technical controls. Key recommendations include:

1. Software Verification: Organizations should enforce strict policies regarding software installation. Users should only download software from official, verified portals, and IT departments should use Application Control or AppLocker to prevent unauthorized binaries from executing.
2. ClickFix Awareness: Security awareness training should specifically include the ClickFix tactic, educating users never to copy and paste commands from a browser pop-up into a terminal or PowerShell window.
3. Memory Monitoring: Since the WLDR agent operates in-memory, organizations should deploy advanced endpoint security solutions capable of monitoring for anomalous PowerShell behavior and memory-only execution patterns.
4. Cryptocurrency Security: Individuals and organizations dealing with digital assets should utilize hardware wallets or multi-signature configurations, which are less susceptible to theft via browser-based malware like Starland RAT.
5. Network Auditing: Security teams should monitor for unusual outbound traffic to Telegram API endpoints and known blockchain gateways, which may indicate C2 communication or data exfiltration.

As UAT-11795 continues to evolve, its reliance on bespoke tooling and blockchain-backed infrastructure suggests that it will remain a persistent threat in the global cyber landscape. The group’s ability to successfully exploit the "human element" serves as a stark reminder that the most effective cyberattacks often rely on the simplest deceptions.