A sophisticated Russian threat actor, UAT-11795, is hijacking legitimate software like Zoom and WebEx to deploy the Starland RAT and steal cryptocurrency.

Key Takeaways

  • Russian threat actor UAT-11795 is using trojanized versions of Zoom, WebEx, and MobaXterm.
  • The primary payload is 'Starland RAT', designed to steal crypto assets and credentials.
  • The attack utilizes a 'ClickFix' method and sophisticated fallback mechanisms via Polygon smart contracts.
  • Targets include the U.S., Germany, Romania, and Venezuela.

In a sophisticated breach of digital trust, a financially motivated Russian threat actor, identified as UAT-11795, has launched a widespread campaign targeting users of widely trusted communication and developer tools. According to a recent report by Cisco Talos, the attackers are distributing trojanized installers for legitimate software, including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT, to deploy a highly dangerous new backdoor known as Starland RAT.

The Anatomy of the Attack

The infection chain is meticulously engineered to evade traditional detection. The attack typically begins with an HTA file that triggers the download of a trojanized NSIS installer. To mask its presence, the malicious payload is disguised as a harmless text file named LICENSE.txt. Once executed, the Python-based loader modifies the Windows Registry to ensure persistence, allowing the malware to survive system reboots. This leads to the deployment of the Starland Remote Access Trojan (RAT).

Read Also:Maharashtra ATS launches probe into 102 individuals linked to Pakistani gangster Shahzad Bhatti

Data Exfiltration and Capabilities

Starland RAT is built for high-value theft. Once active, it conducts an exhaustive search for sensitive information, including cryptocurrency wallet assets (targeting over 40 types of desktop and browser extensions), browser credentials, and system-specific identifiers like HWID and public IP addresses. Furthermore, it probes Active Directory information to understand the victim's domain privileges, potentially enabling lateral movement within corporate networks.

The malware's versatility is alarming. It can capture real-time screenshots, execute shell commands, and inject shellcode. In many observed cases, the attack chain escalates to deliver CastleStealer—which targets Discord, Telegram, and Steam credentials—or Remcos RAT, which provides full remote control, including webcam access and keylogging.

Advanced Evasion Techniques

What sets UAT-11795 apart is its resilience. The malware employs a unique command-and-control (C2) redundancy mechanism. If its hardcoded communication addresses are blocked, it queries a Polygon smart contract to retrieve an XOR-encrypted fallback domain. This use of blockchain technology for C2 communication makes the malware exceptionally difficult to shut down through traditional domain blocking.

Recommendations for Organizations

Security professionals urge organizations to implement strict application whitelisting and to monitor for unusual PowerShell activity. Users are advised to never execute commands found online and to ensure all software is downloaded exclusively from official vendor portals to mitigate the risk of installing compromised installers.