A new Russian-speaking threat actor, tracked as UAT-11795, is aggressively targeting victims across the United States and Europe, according to IT Pro, This group has been active since June of last year, employing trojanized installers for legitimate software to steal credentials and cryptocurrency, according to Cisco Talos.
UAT-11795 utilizes novel tools, including the Python-based Starland RAT and the PowerShell-based WLDR agent, which operates entirely in-memory with encrypted beaconing and a Runspace execution engine. Both tools are designed to exfiltrate credentials, browser data, and cryptocurrency wallet assets, while establishing persistent access.
Cisco Talos reported that the group even hides a fallback command-and-control channel within a Polygon smart contract. Infections have been primarily observed in the US, but also in Germany, Romania, and Venezuela.
The group gains initial access through social engineering tactics, tricking users into executing a command that downloads a weaponized HTA file, leading to the installation of trojanized software.
Cybersecurity experts assert this campaign highlights a shift in attack vectors, exploiting user trust in legitimate software and social engineering over traditional software vulnerabilities. Users are advised to exercise caution, verify software sources, and monitor for unexpected processes.
Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.
Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.
An error occurred trying to play the stream. Please reload the page and try again.
CloseRegistering with SC Media is 100% free. Join tens of thousands of cybersecurity leaders today and gain access to the latest analysis shaping the global infosec agenda.
