Back Scworld

New Russian-speaking threat actor UAT

Scworld • July 17, 2026

Coverage from IT Pro indicates a new Russian-speaking threat actor, tracked as UAT-11795, is aggressively targeting victims across the United States and Europe. This group has been active since June of last year, employing trojanized installers for legitimate software to steal credentials and cryptocurrency, according to Cisco Talos.

UAT-11795 utilizes novel tools, including the Python-based Starland RAT and the PowerShell-based WLDR agent, which operates entirely in-memory with encrypted beaconing and a Runspace execution engine. Both tools are designed to exfiltrate credentials, browser data, and cryptocurrency wallet assets, while establishing persistent access. Cisco Talos reported that the group even hides a fallback command-and-control channel within a Polygon smart contract. Infections have been primarily observed in the US, but also in Germany, Romania, and Venezuela.

The group gains initial access through social engineering tactics, tricking users into executing a command that downloads a weaponized HTA file, leading to the installation of trojanized software. Cybersecurity experts note this campaign highlights a shift in attack vectors, exploiting user trust in legitimate software and social engineering over traditional software vulnerabilities. Users are advised to exercise caution, verify software sources, and monitor for unexpected processes.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian UAT-11795 Targets Users with Trojans in Legitimate Software A Russian threat actor known as UAT-11795 has been deploying the Starland RAT and WLDR agent since June 2025, primarily targeting users in the U.S., Germany, Romania, and Venezuela. The group uses trojanized installers for popular applications like WebEx and Zoom to steal credentials and cryptocurrency. Initial access is gained through social engineering tactics, tricking users into executing malicious HTA files. The malware establishes persistence by modifying the Windows Registry and employs a fallback command-and-control channel hidden within a Polygon smart contract. Cisco Talos has reported that the malware can capture screenshots, execute commands, and exfiltrate sensitive data. Organizations are advised to follow the indicators of compromise (IoCs) provided by Cisco Talos and to be cautious about software sources. 5 sources 75

Extracted Entities

New Russian-speaking threat actor UAT

The full story

Extracted Entities

Attack Types (2)

Countries (4)

Malware (2)

MITRE ATT&CK (2)