As reported by BleepingComputer, a financially motivated Russian threat actor designated UAT-11795 has been caught distributing trojanized versions of widely trusted collaboration platforms — specifically WebEx and Zoom — as delivery vehicles for a newly identified backdoor dubbed Starland RAT. This campaign is a textbook example of supply-chain-adjacent abuse, and it deserves serious attention from security teams across industries.

Threat Alert: As reported by BleepingComputer, a financially motivated Russian threat actor designated UAT-11795 has been caught distributing trojanized versions of widely trusted collaboration platforms — specifically WebEx and Zoom — as delivery vehicles for a newly identified backdoor dubbed Starland RAT.

Why This Campaign Is Especially Dangerous

The strategic choice of WebEx and Zoom as lure vehicles is not accidental. These applications enjoy near-universal deployment across enterprise, government, and remote-work environments, and users have been conditioned to download and install updates without scrutiny. By packaging malware inside what appears to be a legitimate installer, UAT-11795 sidesteps much of the psychological friction that typically causes users to hesitate before running an unknown executable.

What makes Starland RAT particularly concerning is its dual-purpose design: credential harvesting and cryptocurrency theft. This combination suggests the operators are optimizing for maximum financial return per compromised endpoint — targeting both traditional enterprise credentials that can be monetized through account takeovers or sold on criminal markets, and crypto assets that offer near-instant, irreversible liquidity.

Shield53 Perspective: The convergence of credential theft and crypto-draining in a single RAT payload reflects a maturing criminal ecosystem where threat actors are building multi-revenue-stream tools rather than single-purpose stealers. Defenders need to account for this in their threat models.

Who Is Most at Risk

Who Is Most at Risk
Remote and hybrid workforce organizations — high Zoom/WebEx install rates create a large attack surface
Cryptocurrency firms and individual holders — direct financial loss risk beyond credential exposure
Organizations without centralized software distribution controls — users who self-manage software installs are most vulnerable
IT and finance departments — high-value targets given privileged access and financial system credentials
SMBs lacking EDR coverage — RAT persistence and C2 activity is more likely to go undetected in under-resourced environments

The Broader Implications

This campaign is part of a longer-running pattern of Russian financially motivated threat actors — distinct from state-sponsored espionage groups — increasingly targeting the software trust chain. Rather than exploiting zero-days, which are expensive and burn fast, these groups exploit something far more abundant: user trust in brand-name applications. The cost-to-impact ratio strongly favors the attacker here.

Security teams should also note that trojanized software campaigns are frequently used as a precursor to broader network compromise. A Starland RAT implant on an endpoint with access to corporate VPN credentials or privileged identity tools is not just a credential theft event — it's a potential foothold for lateral movement, ransomware staging, or long-term espionage.

Shield53 Recommendations

Immediate Actions

  • Audit your software distribution pipeline: Ensure WebEx, Zoom, and all collaboration tools are installed exclusively via verified enterprise deployment channels (SCCM, Intune, etc.) or official vendor portals with hash verification.
  • Block unofficial installer sources: Use application control policies (AppLocker, WDAC) to prevent execution of unsigned or untrusted executables masquerading as known applications.
  • Hunt for Starland RAT indicators: Review EDR telemetry for anomalous processes spawned from collaboration app installer paths, unexpected outbound C2 connections, and credential store access patterns.
  • Enforce MFA universally: Even if credentials are stolen, strong MFA on email, VPN, and SaaS platforms significantly limits usable stolen credentials.
  • Harden crypto asset access: Any device used to access cryptocurrency wallets or exchanges should be isolated, fully patched, and monitored with behavioral EDR.

Longer-Term Controls

  • Implement a formal software approval and allowlisting program — every new installer should be vetted and signed before reaching endpoints.
  • Train users specifically on the risks of downloading software from third-party sites, even when the branding looks legitimate.
  • Consider deploying browser isolation or sandboxing for high-risk download scenarios.
  • Integrate threat intelligence feeds that track UAT-11795 and related financially motivated Russian actors to stay ahead of new lure themes.

This campaign is a reminder that threat actors don't always need sophisticated exploits — sometimes the most effective weapon is a familiar logo and a convincing installer. Defense starts with controlling what software runs in your environment and never assuming that a trusted brand name guarantees a safe file.