UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Talos discloses UAT-11795, a Russian-speaking group deploying a novel Starland RAT and custom C2 implant against European and U.S. targets via trojanized collaboration apps—raising supply-chain trust questions for enterprises relying on consumer-grade installers.
Summary written by editorial AI · Source link below
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
Editorial Analysis
European enterprises using collaboration tools like Zoom and WebEx face direct risk from trojanized installers distributed by a capable financially motivated actor with bespoke tooling that may evade legacy detections.
Immediately audit software download sources, enforce allowlisted vendor URLs, and deploy Talos-published IOCs across detection stacks.
A sophisticated Russian-speaking threat actor is actively targeting European organisations through trojanized business collaboration software, demanding urgent supply-chain verification.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Cisco Talos in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d