Russian-Speaking Cybercriminal Group UAT-11795 Targets Western Infrastructure with Novel Starland RAT and Blockchain-Based Command Infrastructure

Cisco Talos, the threat intelligence arm of Cisco Systems, has published a comprehensive report detailing the activities of a previously unknown Russian-speaking threat actor, currently tracked under the designation UAT-11795. This group has demonstrated a high degree of technical sophistication and persistence, aggressively targeting organizations and individuals across the United States and Europe since at least June 2023. The campaign is characterized by the use of trojanized installers for widely used enterprise and utility software, including Zoom, WebEx, MobaXterm, DBeaver, and the gaming platform FaceIT. By leveraging these trusted applications, UAT-11795 effectively bypasses traditional perimeter defenses to deploy a dual-threat malware suite consisting of a Python-based Remote Access Trojan (RAT) and a PowerShell-based memory implant.

The emergence of UAT-11795 highlights a significant shift in the cyber-threat landscape, where attackers increasingly favor social engineering and the exploitation of human trust over the discovery of zero-day software vulnerabilities. According to the Cisco Talos findings, the primary objective of this group appears to be financial gain, specifically through the theft of sensitive credentials, browser data, and cryptocurrency assets. However, the depth of their access and the persistence of their implants suggest that their capabilities could easily be pivoted toward corporate espionage or broader disruptive activities if the threat actor’s motivations evolve.

The ClickFix Technique: Initial Access and Social Engineering

UAT-11795 utilizes a sophisticated initial access vector known as the "ClickFix" technique. This method relies on psychological manipulation rather than automated exploits. Typically, a victim is lured to a compromised or malicious website that mimics a legitimate service or technical support page. The site displays a fake error message—often suggesting a browser issue or a missing update—and provides a set of instructions for the user to "fix" the problem.

The "fix" involves the user copying a specific command and pasting it directly into their system’s command prompt or PowerShell terminal. By convincing the user to manually execute the command, the attackers effectively bypass browser-based security sandboxes and antivirus warnings that might otherwise flag an automated download. Once the command is executed, it triggers the download of a weaponized HTML Application (HTA) file from a remote server controlled by the group.

This HTA file contains an embedded VBScript that serves as the primary stage-one dropper. Upon execution, the script creates a Windows batch file within the user’s temporary application folder. This batch file is then responsible for downloading the final stage of the infection: a trojanized version of a legitimate software installer. Because the user believes they are installing a tool they need for work—such as the database management tool DBeaver or the remote terminal MobaXterm—they often proceed with the installation, inadvertently granting the malware administrative privileges and a permanent foothold on the system.

The Malware Arsenal: Starland RAT and WLDR Agent

The technical core of UAT-11795’s operations lies in two previously undocumented tools: Starland RAT and the WLDR agent. These tools are designed to work in tandem, providing both a broad range of data exfiltration capabilities and a resilient, stealthy backdoor into the victim’s environment.

Starland RAT is a Python-based remote access tool. Python’s versatility and the ease with which it can be compiled into standalone executables make it an attractive choice for modern threat actors. Starland RAT is specifically engineered to harvest credentials from web browsers, capture system information, and scan for cryptocurrency wallet files. It provides the attackers with a full suite of remote control features, allowing them to upload and download files, execute arbitrary commands, and monitor user activity in real-time.

Complementing the Starland RAT is the WLDR agent, a sophisticated PowerShell-based Command and Control (C2) memory implant. Unlike traditional malware that resides on the hard drive, the WLDR agent operates almost entirely within the system’s RAM. This "fileless" approach makes detection significantly more difficult for standard antivirus solutions, which often focus on scanning files as they are written to or read from the disk.

The WLDR agent features several advanced capabilities, including encrypted beaconing to obfuscate its communication with the C2 server and a task-queuing system that allows the attackers to schedule actions even when the machine is offline. Furthermore, it utilizes a Runspace execution engine, which allows it to execute additional payloads without spawning new processes, further reducing its visibility to endpoint detection and response (EDR) systems.

Blockchain as a Resilient Command and Control Mechanism

One of the most notable aspects of UAT-11795’s infrastructure is its use of decentralized technology for operational resilience. Cisco Talos researchers discovered that the group employs a fallback command-and-control channel hidden within a Polygon smart contract. Polygon is a popular "Layer 2" scaling solution for the Ethereum blockchain, known for its low transaction fees and high speed.

By embedding C2 configuration data—such as backup IP addresses or domain names—into a smart contract, UAT-11795 ensures that their infrastructure cannot be easily dismantled through traditional legal or technical takedowns. Standard C2 domains can be seized by law enforcement or blocked by internet service providers (ISPs), but a smart contract on a public blockchain is immutable and globally accessible. Even if the primary servers are neutralized, the malware on infected machines can query the Polygon blockchain to find the new location of the attackers’ infrastructure. This integration of Web3 technology into cybercrime represents a growing trend of "bulletproof" hosting and communication strategies.

Geographic Distribution and Targeted Demographics

While UAT-11795 is a Russian-speaking group, its victims are primarily located in Western nations. Data from Cisco Talos indicates that the highest concentration of infections is in the United States. However, significant activity has also been detected in Germany and Romania, with additional outliers in Venezuela.

The choice of software to trojanize provides insight into the group’s target demographics. By targeting tools like MobaXterm and DBeaver, the group is likely aiming for IT professionals, system administrators, and database developers. Access to these individuals’ machines often provides a gateway to broader corporate networks, server infrastructure, and sensitive intellectual property. Conversely, the inclusion of Zoom and WebEx allows them to target a general corporate audience, while FaceIT—a platform used for competitive gaming and anti-cheat services—likely targets individuals who may possess significant cryptocurrency assets.

Timeline and Evolutionary Context

The activities of UAT-11795 can be traced back to at least June 2023, coinciding with the creation of a private Telegram channel titled "stuk komanda" (which translates roughly to "knock command" or "thump team"). This channel, controlled by the threat actor, appears to serve as a notification hub for successful infections or a coordination point for the group’s operators.

Over the past 18 months, the group has refined its delivery methods. The shift toward the ClickFix technique suggests a deliberate move away from automated exploit kits, which have become less effective as modern operating systems and browsers have improved their built-in protections. By focusing on the "human element," UAT-11795 has managed to maintain a high success rate in environments that are otherwise well-secured.

Industry Reaction and Expert Analysis

Cybersecurity experts have expressed concern over the "stealth by familiarity" approach used by UAT-11795. Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, noted that the campaign is particularly insidious because it exploits the very tools that define the modern remote and hybrid work environment.

"By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities," Patel stated. He emphasized that when an attacker successfully subverts the tools employees use daily, the traditional "trusted" perimeter of an organization effectively ceases to exist.

Gabrielle Hempel, a security operations strategist at Exabeam, highlighted that this campaign necessitates a fundamental shift in how organizations approach vulnerability management. "We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems," Hempel observed. She argued that the ability to verify the origin and integrity of a binary is now just as critical as patching known CVEs (Common Vulnerabilities and Exposures).

Broader Implications for Cybersecurity Strategy

The discovery of UAT-11795 serves as a stark reminder that technical security controls are only one part of a robust defense strategy. As threat actors become more adept at manipulating user behavior, the importance of security awareness training and "zero-trust" architectures becomes paramount.

For organizations, the primary defense against such threats is the implementation of strict application control policies. Preventing users from executing unapproved installers or running commands in terminal environments can mitigate the risk posed by ClickFix-style attacks. Additionally, monitoring for unusual PowerShell activity and memory-only processes is essential for detecting fileless implants like the WLDR agent.

From a broader perspective, the use of blockchain technology for C2 infrastructure poses a new challenge for the global cybersecurity community. As more groups adopt decentralized protocols, the traditional "cat-and-mouse" game of domain takedowns will become increasingly obsolete, requiring defenders to develop new methods for disrupting the financial and operational lifelines of cybercriminal organizations.

The investigation into UAT-11795 remains ongoing, and security researchers expect the group to continue evolving its tactics. The combination of Russian-speaking origins, sophisticated custom malware, and innovative use of blockchain suggests that UAT-11795 is not a transient threat, but a persistent actor that will continue to challenge Western cybersecurity defenses for the foreseeable future. Organizations are advised to review their endpoint logs for indicators of compromise related to Starland RAT and to reinforce the importance of software supply chain integrity among their workforce.