Russian-Speaking Threat Actor UAT-11795 Targets US and Europe with Novel Starland RAT and Blockchain-Based Command and Control

Cisco Talos researchers have identified a sophisticated and aggressive cyber-espionage and financial theft campaign orchestrated by a previously undocumented Russian-speaking threat actor. Tracked as UAT-11795, this group has been systematically targeting organizations and individuals across the United States and Europe since at least June 2023. The campaign is characterized by its reliance on social engineering rather than traditional software vulnerabilities, utilizing trojanized versions of popular legitimate software to deploy a custom-built malware suite. The primary objectives of the group appear to be the theft of sensitive credentials and the exfiltration of cryptocurrency assets, marking a significant convergence of professionalized cyber-espionage techniques with financially motivated cybercrime.

The emergence of UAT-11795 highlights a growing trend in the threat landscape where attackers exploit the "human element" within remote and hybrid work environments. By leveraging the tools that modern professionals rely on daily—such as video conferencing and database management software—the threat actor has successfully bypassed traditional perimeter defenses. According to the Cisco Talos intelligence report, the group’s operations are underpinned by a novel technical infrastructure, including a Python-based Remote Access Trojan (RAT) dubbed "Starland" and a memory-only PowerShell implant known as the "WLDR" agent.

The Infection Vector: ClickFix and Social Engineering

The initial access phase of UAT-11795’s operations relies on a technique known as "ClickFix." This method involves deceptive web overlays or pop-up messages that mimic legitimate system errors or browser update notifications. When a user visits a compromised or malicious website, they are presented with a message claiming that a software component failed to load or that a browser fix is required. The user is then prompted to copy a specific command to their clipboard and execute it via the Windows Command Prompt or PowerShell.

This maneuver effectively bypasses automated security filters because the malicious action is performed by the user themselves, often under the guise of troubleshooting. Once the command is executed, it triggers a chain of events starting with the download of a weaponized HTML Application (HTA) file. This HTA file contains embedded VBScript that drops a Windows batch file into the user profile’s temporary application folder. This batch file is then responsible for downloading and installing the final payloads: trojanized versions of legitimate software.

The group has been observed spoofing a variety of high-trust applications, including:

• MobaXterm: A popular terminal for remote computing.
• WebEx and Zoom: Ubiquitous video conferencing platforms.
• DBeaver: A universal database tool used by developers and admins.
• FaceIT: A leading platform for online competitive gaming.

By bundling malware with these installers, UAT-11795 ensures that the victim remains unaware of the compromise, as the legitimate software continues to function as expected while the malicious components operate silently in the background.

Technical Analysis of Starland RAT and WLDR Agent

Central to the success of UAT-11795 is the deployment of two previously undocumented tools: Starland RAT and the WLDR agent. These tools provide the attackers with both persistent access and the ability to execute complex commands on the victim’s machine.

Starland RAT

The Starland RAT is a Python-based malware designed for comprehensive system control. Its architecture allows it to perform a wide range of malicious activities, including:

• File Manipulation: The ability to upload, download, and delete files on the host system.
• Credential Harvesting: Specifically targeting browser-stored passwords, cookies, and auto-fill data.
• System Enumeration: Collecting detailed information about the victim’s hardware, network configuration, and installed software.
• Shell Execution: Running arbitrary commands through the system’s command-line interface.

Because it is written in Python and often bundled with a portable Python interpreter, the RAT can run on systems without requiring a pre-installed Python environment, making it highly portable across different Windows configurations.

WLDR Agent

Complementing the Starland RAT is the WLDR agent, a PowerShell-based Command and Control (C2) memory implant. The WLDR agent is particularly dangerous due to its "fileless" nature; it resides entirely in the system’s RAM, leaving a minimal footprint on the physical disk and making it difficult for traditional antivirus solutions to detect.

Key features of the WLDR agent include:

• Encrypted Beaconing: The agent periodically "calls home" to the attacker’s server using encrypted communication to receive new instructions.
• Task Queuing: It can manage multiple tasks simultaneously, prioritizing actions based on the attacker’s needs.
• Runspace Execution: Utilizing a Runspace execution engine, the agent can execute additional PowerShell payloads without spawning new processes, further evading detection by behavior-based security tools.

Blockchain-Based Resilience: The Polygon Smart Contract

One of the most innovative aspects of UAT-11795’s infrastructure is its use of decentralized technology for command-and-control resilience. Cisco Talos discovered that the group utilizes a smart contract on the Polygon blockchain as a fallback C2 channel.

In the event that the primary C2 domains are taken down by security researchers or law enforcement, the malware is programmed to query a specific address on the Polygon network. The smart contract acts as a permanent, immutable ledger where the attackers can post updated C2 server addresses. Because the blockchain is decentralized and cannot be easily "shut down," this provides the threat actor with a highly resilient infrastructure that ensures they maintain contact with infected machines even during active mitigation efforts. This use of "Web3" technology for malicious purposes represents a sophisticated shift in how threat actors maintain persistence.

Chronology and Geographic Distribution

The activities of UAT-11795 have been tracked through a series of tactical shifts over the past year:

• June 2023: Initial signs of activity emerge. The group establishes a private Telegram channel titled "stuk komanda" (translated as "knock command" or "hit team"), which appears to serve as a coordination hub or a log for successful infections.
• Late 2023: The group begins refining its trojanized installers, focusing heavily on IT and administrative tools like DBeaver and MobaXterm to target high-value users.
• Early 2024: Adoption of the ClickFix social engineering technique leads to a surge in infections. The group expands its target list to include gaming platforms like FaceIT, likely to target cryptocurrency wallets held by younger, tech-savvy users.
• Mid-2024: Cisco Talos identifies the novel Starland RAT and WLDR agent, leading to the public disclosure of the group’s operations.

While the primary concentration of victims is in the United States, significant infection clusters have also been identified in Germany, Romania, and Venezuela. The broad geographic reach suggests that the group is not targeting specific industries but is instead casting a wide net to maximize financial gain through the theft of digital assets and corporate credentials.

Expert Reactions and Industry Impact

Cybersecurity experts have expressed concern over the group’s ability to bypass modern security stacks by exploiting user trust. Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, noted that the campaign is particularly effective because it targets the very tools that facilitate the modern remote workforce.

"By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities," Patel stated. He emphasized that as long as users are conditioned to trust software installers and browser prompts, these "malware-free" entry points will remain a primary threat.

Gabrielle Hempel, security operations strategist at Exabeam, highlighted the shift in how organizations must approach vulnerability management. "This story is so interesting, not because of the trojans, but because of the way it shifts how we need to think about vulnerability management," Hempel said. "We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems."

Hempel argued that if a security program cannot quickly identify the origin of a binary or a command executed by a user, it is essentially "behind on its threat model."

Analysis of Implications

The rise of UAT-11795 signifies several critical shifts in the cyber threat landscape. First, the move toward "living off the land" and utilizing user-initiated commands (like ClickFix) suggests that automated detection at the gateway is becoming less effective. When a user manually copies and pastes a malicious string into a command prompt, they are effectively granting the attacker "authorized" access that bypasses many heuristic filters.

Second, the integration of blockchain technology for C2 resilience indicates a level of technical maturity usually reserved for state-sponsored actors. While UAT-11795 appears to be primarily financially motivated, their infrastructure is built to withstand the types of takedown efforts typically employed against large-scale botnets.

Finally, the targeting of cryptocurrency wallets alongside traditional credentials suggests that threat actors are diversifying their monetization strategies. Credential theft allows for long-term access and potential corporate espionage or ransomware deployment, while cryptocurrency theft provides immediate, liquid financial rewards.

Recommendations for Mitigation

To defend against the tactics employed by UAT-11795, organizations are advised to move beyond simple patch management and focus on behavioral analysis and user education. Key recommendations include:

• Endpoint Detection and Response (EDR): Deploying EDR solutions that can monitor for unusual PowerShell behavior, such as the creation of Runspaces or the execution of commands from the clipboard.
• Application Whitelisting: Restricting the ability of users to run unapproved installers or execute commands in administrative shells.
• User Training: Educating employees on the "ClickFix" technique, specifically advising them that no legitimate website or support service will ever ask a user to copy and paste code into a command prompt to fix a browser error.
• Multi-Factor Authentication (MFA): Implementing robust MFA to mitigate the impact of stolen credentials, although attackers are increasingly finding ways to bypass legacy MFA through session hijacking.

As UAT-11795 continues to operate, the cybersecurity community remains on high alert. The group’s ability to blend social engineering with high-tech resilience makes them a formidable opponent in the ongoing battle to secure the digital workspace.