Russian Hackers Use Trojanized Software to Spread Malware, Targeting Users Globally
A financially motivated Russian threat actor has been using trojanized versions of popular software applications to distribute a new backdoor called Starland RAT. The malicious operation, tracked as UAT-11795 by cybersecurity researchers at Cisco Talos, has been ongoing since June 2025 and has affected users in the United States, Germany, Romania, and Venezuela.
The threat actor’s modus operandi involves distributing trojanized installers for legitimate software such as MobaXterm, WebEx, Zoom, DBeaver, and FaceIT. While researchers couldn’t confirm the infection vector, they speculate that the malicious files are likely pushed using the ClickFix method. Once the user installs the trojanized software, the malware begins to execute.
The attack starts with an HTA file that retrieves a trojanized NSIS installer containing a Python loader disguised as a text file (LICENSE.txt). The loader modifies the Windows Registry to establish persistence and then decrypts and loads the Starland remote access trojan (RAT). When launched, Starland checks whether it is running in a sandbox environment, adds scheduled tasks and Startup folder items for persistence, and tries to increase its privileges.
The malware has a wide range of capabilities, including stealing browser data and cryptocurrency wallet assets, system details, active directory information, and capturing screenshots. It can also execute shell commands, inject shellcode, and download additional payloads. In the observed attacks, the 64-bit shellcode chain delivers the CastleStealer info-stealer malware, while the 32-bit chain delivers the Remcos remote access trojan (RAT).
CastleStealer targets browser credentials, cryptocurrency wallet information, Discord and Telegram sessions, Steam credentials, and filesystem files. Remcos RAT provides capabilities such as keylogging, webcam and screen capture, audio recording, clipboard monitoring, file management, and remote command execution.
What’s particularly concerning about this malware is its use of a previously undocumented PowerShell C2 framework called WLDR. This framework uses encrypted (PBKDF2-SHA256) beaconing and communications and operates entirely in memory, making it difficult to detect. The threat actor also uses a redundancy mechanism for command-and-control communication, involving querying a Polygon smart contract with an XOR-encrypted fallback domain.
To defend against UAT-11795 attacks, organizations should use the indicators of compromise (IoCs) listed in the Cisco Talos report. Individuals can take steps to protect themselves by avoiding executing commands found online if they don’t understand what they do and downloading software only from confirmed official vendor portals.
In today’s threat landscape, it’s essential for security teams to stay vigilant and proactive. Conducting regular breach and attack simulation tests can help identify vulnerabilities in your environment and improve detection capabilities. By taking these steps, you can reduce the risk of falling victim to sophisticated malware operations like UAT-11795.
Source: Bleeping Computer — 2026-07-16