The Financial Engine Behind the Attack
Let's be honest: most cyberattacks are messy. They're chaotic, opportunistic, often half-baked. But UAT-11795? This group operates like a hedge fund with a scripting team.
They don't brute-force their way in. They don't spam phishing emails until someone bites. They wait. They watch. They pick the exact moment when a user is desperate for a software update—maybe they're mid-meeting on Zoom, or trying to share a presentation via WebEx—and they slide in through the backdoor of a legitimate installer. This isn't hacking. It's social engineering with surgical precision.
The motive? Pure financial gain. Not espionage. Not sabotage. Not geopolitical posturing. Just cold, hard crypto theft and credential harvesting. They're not after your company's secrets—they're after your crypto wallet, your corporate AD credentials, and your browser's saved passwords. And they've built a machine to extract it all.
This is the new reality: AI-powered cyber threats aren't always about neural nets or LLMs. Sometimes, they're just old-school malware, weaponized by a team that understands human behavior better than your IT department.
The Trojan Horse Is a .exe File Now
You think you're safe because you only download software from official sources? Good. You're wrong.
UAT-11795 isn't hosting fake Zoom installers on shady .onion sites. They're poisoning the real ones. Cisco Talos found modified versions of WebEx, Zoom, MobaXterm, DBeaver, and FaceIT—all legitimate, all signed, all distributed through the same channels you'd trust. The infection chain starts with an HTA file, likely delivered via a phishing email disguised as a "software update notice" or a "license renewal alert."
Once executed, that HTA pulls down a trojanized NSIS installer. NSIS is a popular, open-source installer framework used by thousands of apps. It's trusted. It's invisible. And it's now the perfect delivery vehicle.
Inside that installer? A Python script disguised as LICENSE.txt. No .exe. No .dll. Just plain text. But when executed, it decrypts and drops Starland RAT—a sophisticated, modular backdoor that doesn't just sit there. It hunts.
Starland RAT: The Silent Asset Harvester
Starland doesn't scream. It whispers.
It checks for sandbox environments first. If it detects VMWare, VirtualBox, or any trace of analysis, it shuts down. No alerts. No logs. Just silence.
If it's home, it gets to work:
- Adds itself to the Windows Startup folder and creates scheduled tasks to survive reboots
- Tries to escalate privileges—because why settle for user-level access when you can own the machine?
- Scans for over 40 cryptocurrency wallets: Exodus, Electrum, MetaMask, Ledger Live, Trust Wallet—you name it
- Pulls browser data from Chrome, Edge, Firefox: saved passwords, autofill, cookies, history
- Harvests system details: hardware ID, RAM, OS version, public IP, even antivirus software
- And here's the kicker—it queries Active Directory for domain structure, domain controllers, and your exact permissions
This isn't random theft. It's reconnaissance. They're mapping your entire network from inside your workstation. And they're not done yet.
The Payload Chain: CastleStealer and Remcos RAT
Starland isn't the endgame. It's the delivery truck.
Once it's settled in, it deploys two secondary payloads—each optimized for a different architecture:
- The 64-bit shellcode drops CastleStealer, an info-stealer that targets Discord, Telegram, Steam, and local file systems. It doesn't just steal passwords—it grabs session cookies so it can log into your accounts without needing credentials.
- The 32-bit shellcode delivers Remcos RAT, a full-featured remote access tool that can record your webcam, capture your screen, log every keystroke, and even hijack your clipboard to swap crypto addresses.
Together, they form a lethal synergy. CastleStealer cleans out your digital wallet. Remcos watches you while you sleep. And Starland? Starland just sits there, breathing quietly, waiting for the next command.
The C2 That Lives in the Blockchain
Here's where it gets creepy.
Most malware uses hardcoded C2 servers. Easy to block. Easy to take down.
UAT-11795? They built redundancy into the blockchain.
If their primary C2 server goes dark—and trust me, it will—they query a Polygon smart contract. Inside that contract? An XOR-encrypted domain name. The malware decrypts it on the fly, connects, and resumes beaconing. No DNS logs. No IP whitelist to block. Just a transaction on a public ledger, hiding in plain sight.
And then there's WLDR.
Cisco Talos calls it "undocumented." I call it genius.
WLDR is a PowerShell-based C2 framework that operates entirely in memory. No files written to disk. No registry keys to flag. It uses PBKDF2-SHA256 encryption to beacon back to the C2, and it binds every command to your machine's hardware identifier. That means if you reinstall Windows? It won't connect. It waits. It's patient. It's persistent.
This isn't malware. It's a ghost.
How to Stop This Before It Starts
Here's the brutal truth: you can't stop this with firewalls or EDR alone.
You need behavioral discipline.
- Never run scripts from email. Ever. HTA files are not documents. They're executable code.
- Verify software sources. If you're told to download Zoom from a link in an email, go to zoom.us yourself. Don't trust the link.
- Use application allowlisting. If your team can't install software without IT approval, you've just eliminated 90% of this attack surface.
- Monitor for PowerShell execution in non-standard contexts. WLDR doesn't leave files. But it leaves traces in Sysmon logs.
- Audit your Active Directory. If your users have domain admin rights just because they "used to be admins," fix it. Now.
And if you're using a cloud-based identity provider? Make sure your MFA isn't just SMS. Use FIDO2 keys. Or at least authenticator apps.
This isn't about patching a vulnerability. It's about changing how your team thinks about trust.
Because the next time someone sends you a "Zoom update," they won't be asking you to click. They'll be counting on you to believe.
