Russian Threat Group Leverages Trojan Apps

A financially motivated Russian operation, identified as UAT-11795, has launched a widespread campaign targeting users of common business and utility software. By distributing trojanized installers, the threat actor aims to compromise systems to exfiltrate sensitive data and cryptocurrency holdings through the use of a novel backdoor known as Starland RAT.

Tactical Distribution and Initial Access

The campaign has been active since at least June 2025. Researchers have observed the threat actor distributing malicious payloads hidden within installers for applications such as WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. While the exact initial infection vector remains unconfirmed, security analysts suspect the ClickFix method is used to trick users into executing the malicious code.

Once the initial HTA file is executed, it fetches a trojanized NSIS installer. This package includes a Python loader masquerading as a text file named LICENSE.txt. This loader initiates the compromise by modifying the Windows Registry to ensure persistence before decrypting the primary RAT payload.

Capabilities of the Starland Implant

Upon infection, the malware performs several defensive evasion checks to ensure it is not running within a sandbox environment. It establishes long-term access by creating scheduled tasks and modifying the Windows Startup folder. The Starland RAT is designed for high-impact data theft and system control, gathering comprehensive information about the host.

• System environment data, including processor details, RAM, OS version, and installed antivirus software.
• Active Directory information, such as domain controller structure and specific victim privileges.
• Cryptocurrency wallet assets covering over 40 distinct desktop and browser-extension wallets.

The malware also supports advanced features, including the ability to execute shell commands, inject both 32-bit and 64-bit shellcode, and capture desktop screenshots. Depending on the architecture of the infected machine, the implant deploys secondary payloads like CastleStealer or Remcos RAT to further expand its operational reach.

C2 Framework and Redundancy

The threat actor utilizes a sophisticated command-and-control infrastructure. When the primary hardcoded C2 server is unreachable, the malware attempts to contact a fallback domain retrieved by querying a Polygon smart contract. Furthermore, the group employs an undocumented PowerShell framework dubbed WLDR.

This framework operates entirely in system memory and utilizes encrypted PBKDF2-SHA256 beaconing. To ensure the exclusivity of their control, the attackers bind payload delivery directly to the hardware identifier (HWID) of the specific victim machine.

Implications for System Security

The use of trojanized legitimate software highlights the ongoing risk posed by unofficial download channels. Because the malware is designed to target both enterprise domain privileges and personal financial assets, organizations must prioritize software verification. Security teams are advised to review the indicators of compromise detailed by Cisco Talos to detect potential infections within their environments. Relying exclusively on official vendor portals for software acquisition remains the primary defense against this type of supply-chain-style masquerading.