UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Talos discloses UAT-11795, a Russian-speaking group deploying a novel Starland RAT and custom C2 implant against European and U.S. targets via trojanized collaboration apps—raising supply-chain trust questions for enterprises relying on consumer-grade installers.
Summary written by editorial AI · Source link below
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
Editorial Analysis
European enterprises using collaboration tools like Zoom and WebEx face direct risk from trojanized installers distributed by a capable financially motivated actor with bespoke tooling that may evade legacy detections.
Immediately audit software download sources, enforce allowlisted vendor URLs, and deploy Talos-published IOCs across detection stacks.
A sophisticated Russian-speaking threat actor is actively targeting European organisations through trojanized business collaboration software, demanding urgent supply-chain verification.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Cisco Talos in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d