Russian Campaign Targets Vital Software

A persistent and financially motivated threat actor known as UAT-11795 has launched a targeted offensive, turning ubiquitous productivity and administrative software into clandestine delivery vehicles for malicious payloads. By masquerading as legitimate installers, these attackers have successfully bypassed routine security expectations to compromise systems with a custom backdoor.

This campaign, which security analysts have actively monitored since June 2025, demonstrates a methodical approach to infrastructure compromise, aiming to harvest everything from browser credentials to deep cryptocurrency assets. The reach of this operation is significant, impacting users primarily in the U.S., with additional infections identified in Germany, Romania, and Venezuela.

Trojanized Software Facilitates Infiltration

The attackers exploit user trust by bundling malicious components within installers for well-known tools like WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. While the specific infection vector remains under investigation, researchers suspect the operators utilize the ClickFix method to lure users into executing the initial malicious package.

The sequence begins when an HTA file executes, triggering the retrieval of a compromised NSIS installer. Within this package, a Python loader—cleverly disguised as a harmless LICENSE.txt file—is deployed to modify the Windows Registry. This ensures that the malware achieves persistence on the target machine before eventually decrypting and launching the Starland RAT.

Deep System and Asset Exfiltration

Once active, the Starland RAT performs environmental checks to avoid sandbox detection before attempting to escalate its system privileges. The malware is designed to act as a comprehensive data vacuum, aggressively targeting specific high-value targets across the machine.

Cisco Talos says that the attack starts with an HTA file that retrieves a trojanized NSIS installer containing a Python loader disguised as a text file (LICENSE.txt).

— Cisco Talos, cybersecurity research organization

The scope of data exfiltration includes:

• Data from over 40 distinct desktop and browser-extension cryptocurrency wallets.
• Detailed system metrics including HWID, RAM, processor specifications, and installed antivirus software.
• Active Directory infrastructure details, including domain hierarchy and the specific privileges held by the victim.

Complex C2 and Secondary Payloads

The operation utilizes a sophisticated C2 framework known as WLDR, which operates entirely in memory to evade detection. To ensure resilience, the malware includes a redundant communication mechanism, allowing it to query a Polygon smart contract to retrieve an encrypted fallback domain if the primary connection fails.

Depending on the system architecture, the threat actor deploys secondary payloads to further entrench their control:

• 64-bit environments receive the CastleStealer info-stealer.
• 32-bit environments are infected with the Remcos remote access trojan.

Defensive Posture and Implications

For organizations, this campaign underscores the danger of relying solely on perimeter defenses when supply-chain integrity is at risk. The use of Cisco Talos intelligence is recommended for incident response teams looking to update their detection rules. Security professionals must prioritize verifying the legitimacy of software installers, as these Test every layer before attackers do to ensure that persistent threats cannot hide within standard administrative workflows.