A sophisticated new threat actor, tracked by Cisco Talos as UAT-11795, has emerged as a significant force in the global cybercrime landscape. Operating with a focus on financially motivated infiltration, this Russian-speaking group has successfully targeted organizations and individuals across the United States, Europe, and South America. By weaponizing the very software tools essential to modern business operations, UAT-11795 has demonstrated a high degree of technical ingenuity and a concerning ability to bypass traditional perimeter defenses.
The campaign, which has been active since June 2023, leverages a combination of “ClickFix” social engineering tactics and custom-built malware to exfiltrate sensitive credentials and cryptocurrency assets. As security researchers continue to dissect the group’s infrastructure, the campaign serves as a stark reminder of the evolving nature of human-centric cyber threats.
The Mechanics of Deception: How UAT-11795 Operates
At the heart of the UAT-11795 operation is a sophisticated social engineering scheme. Rather than relying solely on technical exploits that might trigger automated detection, the group targets the user—the weakest link in the security chain.
The “ClickFix” Strategy
The attack lifecycle typically begins with a “ClickFix” technique. Victims are lured into executing a seemingly innocuous command, often presented as a solution to a technical problem or a necessary step to access a service. Once the user complies, the system initiates the download of a weaponized Hypertext Application (HTA) file from a remote server.
This HTA file contains embedded VBScript that, once triggered, drops a Windows batch file into the user’s temporary application folder. This script serves as a staging mechanism, facilitating the download of trojanized installers for legitimate business tools, including MobaXterm, WebEx, Zoom, DBeaver, and the competitive gaming platform FaceIT. By masquerading as trusted, industry-standard software, the threat actor ensures that the malicious payload is executed with the user’s implicit trust.
Custom Tooling: Starland RAT and the WLDR Agent
Once the trojanized installer is executed, the group deploys two previously undocumented, highly modular tools designed to maintain long-term access:
- Starland RAT: A Python-based remote access trojan (RAT) that grants the attacker full control over the compromised machine. It is specifically engineered to harvest browser data, saved credentials, and cryptocurrency wallet information.
- WLDR Agent: A PowerShell-based Command-and-Control (C2) memory implant. Operating entirely in-memory—a technique known as “fileless” execution—the WLDR agent leaves minimal forensic footprint on the host’s disk. It features advanced capabilities including encrypted beaconing, task queuing, and a Runspace execution engine that allows the attackers to push and execute additional, secondary payloads at will.
Perhaps most remarkably, the group has integrated a fallback C2 channel within a Polygon smart contract. This decentralization of command-and-control infrastructure makes it significantly more difficult for security teams to sinkhole or disrupt the attacker’s communication lines.
A Chronology of the Campaign
While UAT-11795 appears to have formalized its current operations in mid-2023, the scope of their activity has been steadily expanding.
- June 2023: The group initiates its current campaign cycle. Cisco Talos researchers identify the creation of a private, exclusive Telegram channel dubbed “stuk komanda,” which serves as a nexus for the group’s internal communication. At the time of discovery, the channel maintained a low profile with only three subscribers.
- Late 2023 – Early 2024: The threat actor begins scaling its infrastructure, refining the trojanized installers, and diversifying the list of targeted software. During this period, the group increases its geographic focus, shifting from localized attempts to a broader campaign targeting the US, Germany, Romania, and Venezuela.
- Mid-2024: The discovery of the WLDR agent and the Starland RAT indicates a maturation of the group’s toolkit. The transition to fileless, in-memory implants signals that the group is actively adapting to avoid modern Endpoint Detection and Response (EDR) solutions that rely on traditional file-scanning methods.
- Present Day: Cisco Talos continues to monitor UAT-11795, identifying the group as a persistent threat that prioritizes high-value targets, specifically those handling cryptocurrency or sensitive corporate credentials.
Supporting Data and Technical Observations
The infrastructure behind UAT-11795 is notable for its deliberate obfuscation. By leveraging legitimate software installers, the group effectively blindsides users who have been conditioned to trust updates or standard tool deployments.
The use of the Polygon blockchain as a fallback C2 mechanism is a growing trend among advanced persistent threats (APTs) and sophisticated cybercriminal gangs. Because smart contracts on public blockchains are immutable and distributed, they provide a nearly indestructible communication channel for attackers to push updates to their malware implants, even if the primary C2 server is taken down by law enforcement or internet service providers.
Furthermore, the “stuk komanda” Telegram channel suggests a hierarchical, possibly mercenary, structure. The limited number of subscribers indicates that this is a tight-knit operation, likely consisting of core developers and specialized operators, rather than a broad, automated botnet-for-hire service.
Expert Perspectives and Official Analysis
Industry leaders have weighed in on the implications of the UAT-11795 campaign, emphasizing that this is not merely a technical failure but a shift in the threat landscape.
Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, highlights the psychological element of the attack: “By hiding the Starland RAT inside trusted software and likely utilizing deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities. This is the latest in a string of attacks by hackers using the very tools our remote and hybrid workers rely on.”
Gabrielle Hempel, a security operations strategist at Exabeam, points to a fundamental flaw in current corporate security models. "This story is so interesting, not because of the trojans, but because of the way it shifts how we need to think about vulnerability management," Hempel notes. "We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems. If your security program can’t answer ‘where did this binary come from?’ as quickly as it can answer ‘is this CVE patched?’ then you are behind on your threat model."
Hempel advises that while users should not abandon essential tools like Zoom or WebEx, they must adopt a posture of "healthy skepticism." This involves verifying the source of every download—even if the installer appears to be digitally signed—and implementing robust monitoring for unexpected persistence mechanisms or unauthorized processes.
Implications: The New Paradigm of Security
The UAT-11795 campaign carries profound implications for organizations of all sizes. The era of relying on automated patch management and perimeter firewalls as the primary defenses is clearly drawing to a close.
1. The Death of “Signed Installer” Trust
The fact that UAT-11795 uses trojanized versions of legitimate software demonstrates that digital signatures are no longer a guarantee of safety. Attackers can bypass these controls through various means, including the compromise of legitimate software supply chains or by tricking users into installing software from unofficial mirrors.
2. Behavioral Over Static Analysis
Because the WLDR agent runs entirely in memory, static file analysis is largely ineffective. Modern security operations centers (SOCs) must pivot toward behavioral analysis. Detecting an attack now requires looking for anomalous process behaviors—such as a legitimate software installer spawning PowerShell instances that then connect to external, non-standard IP addresses.
3. Identity and Human Risk
As attackers continue to favor human-centric tactics like ClickFix, security awareness training (SAT) must evolve. Employees should be trained not only to spot phishing emails but to scrutinize the provenance of any software they are prompted to install. The goal should be to foster a culture of “verification-first” computing.
4. Zero Trust Architecture
The UAT-11795 campaign underscores the necessity of a Zero Trust architecture. By assuming that any device—even those running “trusted” software—could be compromised, organizations can limit the blast radius of an infection. This includes segmenting networks to prevent lateral movement and implementing strictly enforced identity management for access to sensitive financial or proprietary systems.
Conclusion
UAT-11795 represents a sophisticated evolution in cybercrime. By blending advanced, fileless malware with classic, highly effective social engineering, they have created a threat that is difficult to detect and even harder to mitigate. As the digital ecosystem becomes increasingly complex, the battle against such actors will be won not just through better software, but through a more rigorous and skeptical approach to the human-machine interface. Organizations that fail to adapt their threat models to account for the “trusted-malware” paradigm are likely to find themselves the next victims of this evolving threat.
About the Author
