Russian-Speaking Cyber Threat Actor UAT-11795 Targets US and Europe with Sophisticated Starland RAT and WLDR Agent Payloads

Cisco Talos has identified and documented the activities of a previously unknown Russian-speaking threat actor, currently tracked as UAT-11795, which has launched a series of aggressive cyberattacks against organizations and individuals across the United States and Europe. Active since at least June 2023, this group has demonstrated a high level of technical proficiency, utilizing a combination of novel malware, sophisticated social engineering tactics, and decentralized infrastructure to compromise targets. The primary objectives of UAT-11795 appear to be dual-pronged: the large-scale theft of sensitive credentials and the exfiltration of cryptocurrency assets, suggesting a strong financial motivation underpinned by advanced persistent threat (APT) methodologies.

The emergence of UAT-11795 highlights a growing trend in the cyber threat landscape where attackers leverage the inherent trust users place in legitimate productivity and development software. By weaponizing installers for widely used tools such as MobaXterm, Cisco WebEx, Zoom, DBeaver, and the gaming anti-cheat platform FaceIT, the threat actor has successfully bypassed traditional perimeter defenses that focus on blocking known malicious domains or unverified file types. This strategy exploits the "trust gap" in modern corporate environments, where employees are frequently required to download and update remote-work and collaboration software.

The Technical Arsenal: Starland RAT and WLDR Agent

The core of UAT-11795’s operations revolves around two bespoke, previously undocumented tools: Starland RAT and the WLDR agent. These tools are designed to provide the attackers with comprehensive control over infected systems while maintaining a low profile to evade detection by standard antivirus and Endpoint Detection and Response (EDR) solutions.

Starland RAT is a sophisticated remote access trojan (RAT) developed in Python. The choice of Python as a development language is significant; it allows for rapid iteration, cross-platform potential, and the ability to bundle the script into a standalone executable using tools like PyInstaller. Once executed on a victim’s machine, Starland RAT establishes a persistent connection to the attacker’s command-and-control (C2) infrastructure. Its primary functions include keystroke logging, screen capturing, file manipulation, and the harvesting of browser-stored credentials. Furthermore, it is specifically programmed to scan for and extract data from cryptocurrency wallet applications, reflecting the group’s focus on liquid digital assets.

Complementing the Starland RAT is the WLDR agent, a highly specialized PowerShell-based C2 memory implant. Unlike traditional malware that resides on the physical disk, the WLDR agent is designed to run entirely within the system’s RAM (Random Access Memory). This "fileless" approach makes it exceptionally difficult for traditional security tools to detect, as there are no malicious binaries for disk-based scanners to identify. The WLDR agent features encrypted beaconing capabilities, allowing it to communicate with the C2 server in a stealthy manner. It also utilizes a Runspace execution engine, which enables it to execute additional payloads and commands directly in memory, providing the attackers with a modular and extensible platform for post-exploitation activities.

Analysis of the Infection Chain: The "ClickFix" Maneuver

The initial access phase of UAT-11795’s campaigns relies heavily on a social engineering technique known as "ClickFix." This method is a refined version of traditional phishing that leverages the user’s psychological desire to resolve technical issues quickly. Typically, a victim is lured to a compromised or malicious website that displays a fake error message, often mimicking a legitimate browser or system notification. The message informs the user that a specific component (such as a font or a document viewer) is missing or that a "fix" is required to view the content.

The user is then prompted to copy a specific string of code—often a PowerShell command—and paste it into their system’s "Run" dialog or a terminal window. This action effectively bypasses the browser’s security sandbox, as the user is manually executing the code with their own privileges. Once the command is executed, it triggers the download of a remotely hosted, weaponized HTML Application (HTA) file.

This HTA file contains an embedded VBScript that initiates the next stage of the attack. It drops a Windows batch file into the temporary application folder of the user’s profile. This batch file is then responsible for downloading and installing the trojanized version of legitimate software (such as Zoom or MobaXterm) from an attacker-controlled staging domain. While the user believes they are installing a necessary update or tool, the installer simultaneously deploys the Starland RAT and WLDR agent in the background, ensuring the attacker gains immediate and persistent access to the host.

Strategic Resilience: Blockchain-Based Command and Control

One of the most innovative aspects of UAT-11795’s infrastructure is its use of decentralized technology for resilience. Cisco Talos researchers discovered that the group utilizes a fallback command-and-control channel hosted on a Polygon smart contract. In the event that the primary C2 servers are taken down by law enforcement or blocked by security vendors, the malware is programmed to query the Polygon blockchain to retrieve updated C2 server addresses or new instructions.

Using a blockchain for C2 purposes offers the threat actor several advantages. Because the blockchain is decentralized and immutable, it is nearly impossible for authorities to "shut down" the communication channel. This ensures that the attackers can maintain contact with their botnet even under intense pressure. This technique, while still relatively rare, represents a sophisticated shift in how threat actors are preparing for long-term operations and infrastructure longevity.

Geographic Distribution and the "Stuk Komanda" Connection

While the group’s primary targets are located in the United States, Cisco Talos has also observed infections in Germany, Romania, and Venezuela. This geographic spread suggests that while the group may have specific high-value targets in mind, their campaigns are also broad enough to capture a wide array of victims across different industries and regions.

The investigation also uncovered a private Telegram channel titled "stuk komanda" (which translates roughly from Slavic languages as "Knock Command" or "Hit Team"). Created in June 2023, the channel appears to be used by the threat actor for internal coordination or as a repository for exfiltrated data alerts. Although the channel only had a few subscribers at the time of discovery, its existence provides a rare glimpse into the organizational structure of the group, indicating a small, focused team of operators rather than a massive, automated "bot farm."

Expert Perspectives and Industry Impact

Cybersecurity experts have expressed concern over the tactics employed by UAT-11795, particularly their focus on exploiting human psychology and trusted software ecosystems. Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, noted that the campaign is a sobering reminder of how attackers are turning the tools of modern remote work against the workforce.

"By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities," Patel stated. He emphasized that when attackers use the very tools that hybrid and remote workers rely on, the traditional "walled garden" approach to security becomes increasingly ineffective.

Gabrielle Hempel, a security operations strategist at Exabeam, highlighted that the campaign necessitates a fundamental shift in how organizations approach vulnerability management. "We often measure a program’s security maturity by patch SLAs (Service Level Agreements), but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems," Hempel explained. She argued that the ability to verify the origin and integrity of a binary is now just as critical as patching known Common Vulnerabilities and Exposures (CVEs).

Broader Implications for Corporate Security

The activities of UAT-11795 underscore several critical challenges for modern cybersecurity programs. First, the reliance on "living-off-the-land" techniques—such as using PowerShell and memory-resident implants—means that organizations can no longer rely solely on signature-based detection. Behavioral analysis and robust monitoring of system processes are essential to identifying the subtle signs of a WLDR agent infection.

Second, the success of the ClickFix technique demonstrates that user awareness training must evolve. Users need to be educated not just on identifying suspicious emails, but on the dangers of copying and pasting commands from websites, regardless of how legitimate the "error message" may appear.

Finally, the use of trojanized installers for popular IT tools like MobaXterm and DBeaver suggests that IT and DevOps professionals are being specifically targeted. These users often have elevated privileges within a network, making them "whale" targets for attackers. Compromising a single developer or system administrator can provide UAT-11795 with the "keys to the kingdom," allowing for lateral movement and the potential for large-scale data breaches or ransomware deployment.

Conclusion and Mitigation Strategies

As UAT-11795 continues to refine its tactics, the cybersecurity community must adapt. Cisco Talos recommends that organizations implement strict controls over the execution of HTA files and PowerShell scripts, particularly those initiated from browser processes. Furthermore, the use of application whitelisting and the enforcement of "least privilege" principles can significantly limit the damage an attacker can cause even if initial access is gained.

The discovery of UAT-11795 serves as a potent reminder that the threat landscape is not static. As defenses improve, Russian-speaking actors and other sophisticated groups are moving toward more resilient infrastructure and more deceptive social engineering. For organizations in the US and Europe, the message is clear: security is no longer just about fixing bugs; it is about verifying every action, every installer, and every command in an era of diminishing digital trust.