Cybercriminals have evolved their tactics yet again, moving beyond the traditional phishing email to weaponize the very tools that power modern productivity. A new credential theft campaign, linked to the financially motivated Russian threat actor tracked as UAT-11795, is distributing the sophisticated Starland RAT through trojanized installers of widely trusted applications. This operation, active since at least June 2025, demonstrates a dangerous evolution in malware strategy: the fusion of remote access capabilities, cryptocurrency theft, and enterprise-level reconnaissance into a single, persistent threat ecosystem. Targeting users primarily in the United States, with additional infections detected in Germany, Romania, and Venezuela, the Starland RAT campaign serves as a stark warning for organizations and individuals alike.
What is Starland RAT?
Starland RAT is a sophisticated remote access trojan deployed by the threat actor UAT-11795. It functions as the central command module of a multi-stage malware operation, designed to steal credentials, cryptocurrency wallets, and provide attackers with persistent remote control over infected systems. The malware is distributed through fake software installers, tricking victims into believing they are downloading legitimate applications such as Zoom or WebEx.
Trojanized Installers and the ClickFix Technique
The initial access vector for the Starland RAT campaign is notably deceptive. Attackers have created malicious versions of popular software packages, including MobaXterm, WebEx, Zoom, DBeaver, and FaceIT. Victims land on convincing websites or search results offering these applications, but the downloaded installers are weaponized.
This campaign heavily relies on the ClickFix technique. Instead of exploiting a software vulnerability, the attackers manipulate user behavior. Victims are tricked into copying and pasting commands into Windows dialogs or executing instructions presented on a spoofed webpage. This action bypasses many traditional security controls because the malicious action is user-initiated.
The infection chain is initiated by an HTA file, which downloads a modified NSIS installer packed with a Python-based loader disguised as a harmless file named LICENSE.txt.
Inside the Starland RAT Infection Chain
Sandbox Evasion and Persistence
Once executed, the Starland RAT is far from a simple remote access tool. It first performs a detection check to determine if it is running inside a sandbox or a malware analysis environment. If the environment is deemed legitimate, the installer decrypts and launches the Starland RAT payload.
The malware establishes robust persistence to survive system reboots and maintain long-term access. This is achieved through multiple overlapping mechanisms:
- Scheduled tasks
- Windows Startup folder entries
- Registry modifications
- Privilege escalation attempts
These techniques ensure that the attacker can regain access after a system restart, making the infection exceptionally difficult to fully remove without thorough cleanup.
Targeting Credentials and Cryptocurrency Wealth
The primary goal of UAT-11795 is financial gain. Starland RAT searches infected devices for valuable digital assets that can be sold, abused, or used for downstream attacks. The malware is equipped to harvest a wide array of sensitive data:
- Browser passwords and stored credentials
- Cryptocurrency wallet data
- Authentication tokens and session cookies
- Gaming platform credentials
- Messaging application sessions (Discord, Telegram)
- Local files containing sensitive information
Researchers discovered that Starland specifically targets more than 40 cryptocurrency wallets, targeting both desktop applications and browser extensions. For cryptocurrency users, this creates a severe threat, as stolen wallet information allows attackers to transfer digital assets almost instantly with very little recourse for recovery.
Enterprise Espionage Capabilities Hidden Within Financial Malware
While the motivation is financial, the technical capabilities of Starland RAT reveal a tool with espionage-like features. The malware collects detailed system intelligence, including hardware identifiers, CPU and memory information, geographic region, and public IP address. Critically, it gathers Active Directory (AD) information:
- Domain structure
- Domain controllers
- User privileges
- Network environment details
This reconnaissance data allows attackers to map out the target organization, identify high-value corporate targets, and expand their attacks beyond the original infected machine, potentially moving laterally across a network.
Remote Control and Secondary Payload Delivery
Starland RAT provides attackers with extensive remote control capabilities, effectively turning an infected device into a fully operated machine under criminal command. The malware can capture screenshots, execute shell commands, inject malicious shellcode, download additional files, and install new malware components.
This remote access is used to deploy secondary payloads depending on the system architecture:
- CastleStealer (64-bit): An information stealer designed to collect browser credentials, cryptocurrency wallet information, Discord and Telegram sessions, Steam credentials, and local files.
- Remcos RAT (32-bit): A well-known remote access tool that provides keylogging, webcam monitoring, screen recording, audio capture, clipboard theft, and full file management.
This combination creates a powerful criminal toolkit capable of conducting surveillance while simultaneously draining financial assets.
Stealthy Command-and-Control Infrastructure
Starland RAT uses a highly resilient command-and-control (C2) system. If its primary, hardcoded C2 server is taken offline by security teams, the malware contains a fallback mechanism involving the Polygon blockchain network. It queries a Polygon smart contract containing an XOR-encrypted fallback domain, making traditional domain takedown operations far more difficult. Attackers can update the C2 address by simply posting a new transaction to the blockchain.
Adding another layer of sophistication, the threat actor UAT-11795 utilizes a previously undocumented PowerShell-based framework called WLDR. WLDR provides encrypted communication channels, executes entirely in memory, and uses PBKDF2-SHA256 encryption for payload delivery. Because it operates in memory, it often evades traditional file-scanning antivirus solutions.
Defending Against Starland RAT Infections
Preventing infection requires a layered security strategy focused on behavior detection rather than just signature matching. Security teams operating in an environment exposed to the ClickFix or fake installer vectors should review the following key areas for signs of compromise.
Security teams can check suspicious scheduled tasks for persistence by running the command schtasks /query /fo LIST /v. Similarly, investigators can review Windows startup persistence locations with reg query HKCU\Software\Microsofta\Windows\CurrentVersion\Run. Active network connections can be reviewed using netstat -ano. Suspicious PowerShell activity can be identified by querying the PowerShell Operational log using Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational. Running processes can be scanned using tasklist /v.
Organizations should also enforce strict policies for software downloads, blocking unauthorized executable downloads from non-official sources. Deploying endpoint detection and response (EDR) solutions, enabling multi-factor authentication, and restricting administrative privileges are vital controls. Users must be trained to never execute commands copied from a website without fully understanding their purpose, as the ClickFix technique directly exploits this gap in user awareness.
A New Generation of Financially Motivated Malware
The Starland RAT campaign illustrates a clear escalation in the capabilities of financially motivated cybercrime groups. Attackers are no longer content with stealing a single password. They demand persistent access, comprehensive system intelligence, and the ability to return at will when a valuable opportunity arises.
The abuse of trusted software brands like Zoom and WebEx demonstrates how reputation itself has become a weapon. The integration of a custom framework like WLDR and the use of blockchain for resilient C2 infrastructure reveals a growing professionalism within the criminal ecosystem. These groups operate with the rigor of technology companies, investing in tools that are difficult to disrupt using conventional takedown processes.
For defenders, the lesson is clear. Relying solely on antivirus signatures is no longer viable. Combating threats like Starland RAT requires behavior-based detection, identity security, continuous monitoring, and a zero-trust approach to software supply chains. The evolution of these threats demands an equally dynamic evolution in cyber defense strategies.
