Overview of UAT-11795’s Financially Motivated Campaign
Cisco Talos has identified UAT-11795, a sophisticated, Russian-speaking threat actor engaged in a financially motivated campaign targeting users primarily in the United States, with some impact observed in Germany, Romania, and Venezuela. The campaign, active since at least June, aims to steal user credentials and cryptocurrency wallet assets, establishing persistent access to victim machines. UAT-11795 achieves initial compromise through trojanized installers for popular software and deploys novel malware, including the Starland Remote Access Tool (RAT) and the WLDR Command-and-Control (C2) memory implant, as detailed by Cisco Talos.
Initial Access and Malware Deployment
The adversary employs an opportunistic, volume-driven distribution model, leveraging trojanized installers that masquerade as legitimate software. These lures span various categories, indicating a broad targeting approach rather than a single vertical. Notable examples include:
- IT Administration: MobaXterm_v26.1.exe
- Enterprise Collaboration: WebEx_Client.exe, Zoom installer
- Developer Tooling: dbeaver-ce-windows-x86_64.exe (DBeaver Community Edition)
- Consumer Gaming: FaceitInstaller_x64.exe (FACEIT)
Upon successful compromise, UAT-11795 deploys its primary tools. The Starland RAT is a Python-based remote access tool providing adversaries with control over compromised systems. More notably, the WLDR agent is a sophisticated PowerShell-based C2 memory implant. This agent features encrypted beaconing, task queuing, and a Runspace execution engine, allowing for the execution of additional payloads directly in memory, making its detection more challenging for conventional security tools. The actor also uses established malware like CastleStealer and Remcos RAT as alternative payloads.
Infrastructure and Evasion Techniques
UAT-11795 operates a distributed infrastructure for payload staging and persistent C2, using domain naming conventions designed to blend with legitimate traffic. Staging domains like eorthopaedics[.]com, web-devtools[.]com, and zynaris[.]io host PowerShell stage chains, raw shellcode, and trojanized installers. C2 infrastructure is similarly distributed, with domains such as eorthopaedics[.]com and sastoro[.]com handling hardware-bound unique identifier (HWID) encrypted communications, and windowscreenrepairnearme[.]com and aipythondevs[.]com serving as primary C2 for the Starland Python RAT. All C2 URLs incorporate a victim’s hardware identifier, enabling distinct communication channels for each compromised machine.
In a notable display of infrastructure resilience, UAT-11795 utilizes a Polygon smart contract (0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba) to store an XOR-encrypted fallback C2 domain, retrievable via a public JSON-RPC call. This mechanism ensures continued operation even if primary C2 channels are disrupted. Furthermore, the actor employs Telegram bots for receiving execution notification beacons, including victim machine fingerprints and cryptocurrency wallet inventories, which are key indicators of their financially motivated adversary tactics.
Recommendations for Mitigating Trojanized Installer Threats
Organizations and individuals must be vigilant against this opportunistic threat. UAT-11795 Starland RAT WLDR agent detection requires a multi-layered security approach focusing on both initial access vectors and post-exploitation activities.
- User Education: Conduct regular training on identifying phishing attempts and the dangers of downloading software from unofficial or untrusted sources. Emphasize verification of download origins, even for widely used applications.
- Endpoint Detection and Response (EDR): Implement and configure EDR solutions to monitor for suspicious process behavior, unauthorized PowerShell execution, and C2 communication patterns, especially those involving novel memory implants like the WLDR agent.
- Network Monitoring: Employ network intrusion detection systems (NIDS) and actively monitor for connections to known malicious C2 domains or unusual outbound traffic. Pay attention to DNS queries for newly registered or suspicious domains.
- Application Whitelisting: Restrict software execution to only approved applications. This can significantly reduce the risk of trojanized installers successfully deploying malware.
- Patch Management: Keep all operating systems, software, and security solutions updated to patch known vulnerabilities that threat actors might exploit in their campaigns, even if not directly observed in UAT-11795’s current TTPs.
- Cryptocurrency Security: Advise users to employ hardware wallets for cryptocurrency storage, enable multi-factor authentication (MFA) on all crypto exchange accounts, and be extremely cautious of any unsolicited requests for wallet access or seed phrases.
- Credential Hygiene: Enforce strong, unique passwords and enable MFA for all accounts, particularly those with access to sensitive data or financial assets.
Related: OkoBot Framework: Multi-Payload Data & Crypto Theft Attacks, Smoke#Screen RMM Takeover Campaign Targets Enterprise Networks