Back Securityaffairs.Co

New Russian Campaign Uses Fake Webex and Zoom Installers to Deploy Starland RAT

Securityaffairs.Co •Pierluigi Paganini • July 17, 2026

Russian-speaking UAT-11795 spreads trojanized Zoom, Webex, and MobaXterm installers to deliver Starland RAT and the WLDR memory-only implant. Cisco Talos researchers published a detailed technical report on July 16 disclosing UAT-11795, a financially motivated, Russian-speaking threat actor that has been running a malware campaign against users in the United States and Europe since at least […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian UAT-11795 Targets Users with Trojans in Legitimate Software A Russian threat actor known as UAT-11795 has been deploying the Starland RAT and WLDR agent since June 2025, primarily targeting users in the U.S., Germany, Romania, and Venezuela. The group uses trojanized installers for popular applications like WebEx and Zoom to steal credentials and cryptocurrency. Initial access is gained through social engineering tactics, tricking users into executing malicious HTA files. The malware establishes persistence by modifying the Windows Registry and employs a fallback command-and-control channel hidden within a Polygon smart contract. Cisco Talos has reported that the malware can capture screenshots, execute commands, and exfiltrate sensitive data. Organizations are advised to follow the indicators of compromise (IoCs) provided by Cisco Talos and to be cautious about software sources. 6 sources 75

Extracted Entities

New Russian Campaign Uses Fake Webex and Zoom Installers to Deploy Starland RAT

The full story

Extracted Entities

Attack Types (2)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)