Threat Summary
A Russian-speaking, financially motivated threat actor designated UAT-11795 has been conducting a sophisticated malware campaign since June 2025, primarily targeting users in the United States with secondary targets in Germany, Romania, and Venezuela. The operation utilizes ClickFix-style social engineering techniques with trojanized software installers for legitimate applications including MobaXterm, Cisco WebEx, Zoom, DBeaver, and FACEIT. The campaign deploys a multi-stage malware payload chain featuring Starland RAT, WLDR Framework, CastleStealer, and Remcos RAT, indicating a clear focus on credential theft, remote access, and financial data exfiltration. This campaign demonstrates the continued evolution of supply chain-style attacks using legitimate software as an initial infection vector.
Threat Actor / Malware Profile
UAT-11795: A financially motivated Russian-speaking threat actor active since at least June 2025. This actor specializes in credential theft campaigns using trojanized installers as their primary distribution mechanism, with a specific focus on the financial sector.
Malware Families:
-
Starland RAT: A Remote Access Trojan providing adversaries with full system control including keylogging, screenshot capture, and file manipulation. Establishes persistence through registry modifications and scheduled tasks.
-
WLDR Framework: A sophisticated PowerShell-based malware framework used for post-exploitation activities, including credential harvesting, lateral movement, and C2 communication. Uses heavily obfuscated PowerShell scripts to evade detection.
-
CastleStealer: An information stealer specializing in harvesting browser credentials, cryptocurrency wallet data, and application credentials. Targets Chrome, Firefox, Edge, and various cryptocurrency applications.
-
Remcos RAT: A commercial Remote Access Trojan providing comprehensive surveillance capabilities including keystroke logging, screen capture, microphone and webcam access, and file management.
Distribution Method: Trojanized installers for legitimate software distributed through social engineering techniques that mimic software update notifications or official download pages.
Payload Behavior: Multi-stage execution chain starting with a trojanized installer that deploys a loader, establishes C2 communication, and downloads additional payloads based on the target environment.
C2 Communication: Primarily uses HTTP/HTTPS with potential domain fronting or encryption techniques to evade detection.
Persistence Mechanism: Registry run keys, scheduled tasks, and service creation are commonly used by these malware families.
Anti-Analysis Techniques: Code obfuscation, anti-debugging, virtual machine detection, and process hollowing are likely employed by this actor to evade analysis and detection.
IOC Analysis
The provided pulse includes CVE indicators which may be exploited in the attack chain or used as lures in social engineering. A complete operationalization of threat intelligence for this campaign would typically include:
- File hashes (MD5, SHA1, SHA256): For identifying malicious files on endpoints
- IP addresses and domains: For network perimeter blocking and detection in network logs
- URLs: For blocking in web proxy solutions and detection in proxy logs
- CVE identifiers: Vulnerabilities that may be exploited in the attack chain
SOC teams should:
- Import IOCs into SIEM solutions for correlation with internal security events
- Configure EDR solutions to detect and block malicious files
- Update firewall and web proxy rules to block malicious network indicators
- Implement threat intelligence feeds that automatically update these IOCs
Detection Engineering
---
title: Starland RAT Execution via Trojanized Installer
id: 12345678-1234-1234-1234-123456789012
description: Detects execution patterns associated with Starland RAT deployment through trojanized software installers
status: experimental
author: Security Arsenal
date: 2026/08/04
references:
- https://blog.polyswarm.io/clickfix-themed-campaign-deploys-starland-rat-and-wldr-framework
tags:
- attack.execution
- attack.persistence
- attack.t1566.001
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\MobaXterm.exe'
- '\WebEx.exe'
- '\Zoom.exe'
- '\DBeaver.exe'
- '\FACEIT.exe'
Image|endswith:
- '\powershell.exe'
- '\cmd.exe'
- '\mshta.exe'
CommandLine|contains:
- ' -EncodedCommand '
- ' -enc '
- ' -w hidden '
- 'downloadstring'
- 'iex'
condition: selection
falsepositives:
- Legitimate software updates
level: high
---
title: WLDR Framework PowerShell Activity
id: 23456789-2345-2345-2345-234567890123
description: Detects WLDR Framework PowerShell command patterns used in post-exploitation activities
status: experimental
author: Security Arsenal
date: 2026/08/04
references:
- https://blog.polyswarm.io/clickfix-themed-campaign-deploys-starland-rat-and-wldr-framework
tags:
- attack.execution
- attack.defense_evasion
- attack.t1059.001
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|contains:
- 'System.Management.Automation.AmsiUtils'
- 'amsiInitFailed'
- 'Get-WmiObject Win32_Process'
- 'Invoke-Expression'
- 'FromBase64String'
filter_legitimate:
CommandLine|contains:
- 'PowerShell_ISE'
- 'VisualStudio'
condition: selection and not filter_legitimate
falsepositives:
- Legitimate PowerShell administration scripts
level: high
---
title: CastleStealer Credential Theft Indicators
id: 34567890-3456-3456-3456-345678901234
description: Detects indicators of CastleStealer activity related to browser credential theft
status: experimental
author: Security Arsenal
date: 2026/08/04
references:
- https://blog.polyswarm.io/clickfix-themed-campaign-deploys-starland-rat-and-wldr-framework
tags:
- attack.credential_access
- attack.collection
- attack.t1555.003
- attack.t1005
logsource:
category: file_access
product: windows
detection:
selection:
TargetFilename|contains:
- '\Google\Chrome\User Data\Default\Login Data'
- '\Mozilla\Firefox\Profiles\logins.'
- '\Microsoft Edge\User Data\Default\Login Data'
Image|endswith:
- '\powershell.exe'
- '\cmd.exe'
- '\unknown.exe'
condition: selection
falsepositives:
- Legitimate password managers
- Browser updates
level: critical
kql
// Hunt for suspicious child processes from common trojanized applications
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("MobaXterm.exe", "WebEx.exe", "Zoom.exe", "DBeaver.exe", "FACEIT.exe")
| where ProcessFileName in~ ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine contains any ("-EncodedCommand", "-enc", "downloadstring", "iex", "FromBase64String")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine
| order by Timestamp desc
// Hunt for network connections to known C2 infrastructure
DeviceNetworkEvents
| where RemotePort in (80, 443, 8080)
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "unknown.exe")
| where RemoteUrl contains any (".xyz", ".top", ".tk", ".ml", ".cf")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
powershell
# Starland RAT and WLDR Framework IOC Hunt Script
# This script checks for indicators associated with the UAT-11795 campaign
# Check for suspicious scheduled tasks
$suspiciousTasks = Get-ScheduledTask | Where-Object {
$_.Actions.Execute -match "powershell" -and
$_.Actions.Arguments -match "-EncodedCommand|downloadstring|iex"
}
if ($suspiciousTasks) {
Write-Host "WARNING: Suspicious scheduled tasks found:"
$suspiciousTasks | ForEach-Object {
Write-Host "Task Name: $($_.TaskName)"
Write-Host "Action: $($_.Actions.Execute) $($_.Actions.Arguments)"
Write-Host "----------------------------------------"
}
} else {
Write-Host "No suspicious scheduled tasks found."
}
# Check for suspicious registry keys in run persistence locations
$runPaths = @(
"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
"HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($path in $runPaths) {
if (Test-Path $path) {
$suspiciousRunKeys = Get-ItemProperty -Path $path | Where-Object {
$_.PSObject.Properties -match "powershell|cmd|wscript" -and
$_.PSObject.Properties.Value -match "-EncodedCommand|-enc|downloadstring|iex"
}
if ($suspiciousRunKeys) {
Write-Host "WARNING: Suspicious registry keys found in $path:"
$suspiciousRunKeys.PSObject.Properties | ForEach-Object {
Write-Host "$($_.Name): $($_.Value)"
Write-Host "----------------------------------------"
}
}
}
}
# Check for processes with suspicious command lines
$suspiciousProcesses = Get-WmiObject Win32_Process | Where-Object {
$_.CommandLine -match "powershell.*-EncodedCommand|powershell.*-enc|downloadstring|iex"
}
if ($suspiciousProcesses) {
Write-Host "WARNING: Suspicious processes found:"
$suspiciousProcesses | ForEach-Object {
Write-Host "Process ID: $($_.ProcessId)"
Write-Host "Name: $($_.Name)"
Write-Host "Command Line: $($_.CommandLine)"
Write-Host "----------------------------------------"
}
} else {
Write-Host "No suspicious processes found."
}
# Check for suspicious network connections
$suspiciousConnections = Get-NetTCPConnection | Where-Object {
$_.RemotePort -in @(80, 443, 8080) -and
$_.OwningProcess -in ($suspiciousProcesses.ProcessId)
}
if ($suspiciousConnections) {
Write-Host "WARNING: Suspicious network connections found:"
$suspiciousConnections | ForEach-Object {
$process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
Write-Host "Local Address: $($_.LocalAddress):$($_.LocalPort)"
Write-Host "Remote Address: $($_.RemoteAddress):$($_.RemotePort)"
Write-Host "Process: $($process.ProcessName)"
Write-Host "----------------------------------------"
}
} else {
Write-Host "No suspicious network connections found."
}
Response Priorities
Immediate:
- Block all known IOCs (file hashes, IPs, domains, URLs) at perimeter and endpoint defenses
- Conduct a hunt for trojanized installers (MobaXterm, Cisco WebEx, Zoom, DBeaver, FACEIT) across the enterprise
- Isolate any endpoints showing signs of infection with the malware families identified
- Implement temporary blocks for PowerShell execution from suspicious parent processes
24h:
- Conduct credential resets for users who may have been exposed to the campaign
- Review logs for evidence of successful credential theft or data exfiltration
- Implement multi-factor authentication (MFA) for all user accounts
- Conduct a phishing awareness campaign focused on fake software updates
1 week:
- Review and update application whitelisting policies to prevent execution of unsigned binaries
- Implement application control to prevent execution of installers outside of IT-approved channels
- Enhance email filtering to detect and block malicious software update notifications
- Conduct a comprehensive review of the software update process to ensure secure distribution channels
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.