Russian Threat Actors Deploy Starland RAT Through Counterfeit Video Conferencing Installers

Key Findings

• Russian-speaking threat actor UAT-11795 has been running a malware campaign since June 2025 targeting users in the U.S. and Europe

• Campaign distributes trojanized installers for legitimate software including Zoom, Webex, MobaXterm, DBeaver, and FACEIT gaming platform

• Two newly documented malware families deployed: Starland RAT (Python-based) and WLDR (PowerShell memory-only implant)

• Initial access achieved through ClickFix social engineering technique

• Starland RAT includes built-in credential theft and cryptocurrency wallet enumeration capabilities

• C2 infrastructure uses Ethereum smart contracts as backup communication channel

• Russian-language developer comments found in code confirm Russian-speaking threat actor

Background

Cisco Talos researchers disclosed UAT-11795 on July 16, 2026, identifying a financially motivated Russian-speaking threat actor conducting a sophisticated malware campaign across multiple countries. The actor's broad targeting approach, spanning developer tools, business collaboration software, and gaming platforms, suggests they are attempting to compromise a wide variety of user types rather than focusing on specific industries.

Attack Vector and Initial Compromise

The campaign employs a ClickFix social engineering approach where victims are tricked into running a command that downloads and executes a malicious HTA file silently. The HTA drops a Windows batch file and trojanized installer while establishing persistence through a registry Run key. This persistence mechanism re-executes the HTA every time the user logs in.

The trojanized installers are built using the Nullsoft Scriptable Install System (NSIS). They package a real Python runtime alongside a compiled Python loader disguised as a file named LICENSE.txt. When the NSIS script executes the loader, it decrypts Starland RAT using a single-byte XOR key and runs it in memory. Critically, the actual software installation proceeds normally, so victims see exactly what they expected and remain unaware of the compromise.

Malware Analysis

Starland RAT is a Python-based remote access tool that begins execution with multiple anti-analysis checks. It compares the logged-on username against a hardcoded list of known sandbox service accounts including WDAGUtilityAccount. The RAT also verifies the victim's computer name against hostnames from Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis. Additionally, it examines the Downloads folder for a Zone.Identifier alternate data stream on the installer file to confirm the file was obtained via browser download rather than being copied directly. Any mismatch terminates execution immediately.

After clearing these checks, Starland establishes persistence by creating a scheduled task with a randomized name following the pattern PythonLauncher-{3 random characters} and a Startup folder shortcut as a secondary mechanism. It then conducts extensive reconnaissance including hardware ID derived from the C: drive volume serial number, total RAM, installed antivirus, and Active Directory membership status.

If the machine is domain-joined, Starland executes whoami, systeminfo, net user, and nltest commands to map the domain structure. The RAT enumerates over 40 cryptocurrency wallets from both browser extensions and desktop applications, captures a desktop screenshot, and bundles all reconnaissance data into a JSON payload. This payload is XOR-encrypted using the key "helo1" before transmission to the C2 server.

The second malware family, WLDR, is a PowerShell-based command-and-control implant that executes entirely in memory, leaving minimal forensic artifacts.

Command and Control Infrastructure

The C2 design employs a resilient architecture with primary and backup mechanisms. The RAT sends victim registration data to a hardcoded primary C2 domain. However, if that communication fails, it utilizes a Polygon Ethereum smart contract as a backup communication channel, allowing the actor to maintain control even when traditional infrastructure is disrupted.

Additional Payloads

Beyond Starland RAT and WLDR, Talos researchers observed the actor deploying CastleStealer and Remcos RAT as additional payloads delivered through Starland after initial compromise, demonstrating a multi-stage approach to maximize system access and data theft capabilities.

Sources

• https://securityaffairs.com/195532/malware/new-russian-campaign-uses-fake-webex-and-zoom-installers-to-deploy-starland-rat.html

• https://www.linkedin.com/posts/pierluigipaganini_new-russian-campaign-uses-fake-webex-and-activity-7483810134289338368-ruFf

• https://x.com/shah_sheikh/status/2078047280880562628

• https://www.socdefenders.ai/item/e49ff21a-88d6-4c05-9abe-fc20cef7f3a5

• https://www.linkedin.com/posts/dlross_new-russian-campaign-uses-fake-webex-and-activity-7483996461492477952-iDPx