Russian actor hides Starland malware in fake WebEx, Zoom, and dev-tool installers

Cisco Talos detailed a financially motivated Russian group, tracked as UAT-11795, that spreads a new backdoor called Starland RAT through trojanized installers for legitimate software including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. Active since at least mid-2025 and mainly hitting US victims, the campaign likely uses fake verification lures to deliver the installers. Once run, the malware sets up persistence, tries to escalate privileges, and detects sandboxes, then steals browser data and more than 40 kinds of cryptocurrency wallets, profiles the machine, and maps Active Directory. It can take screenshots, run shell commands, inject shellcode, and pull down further payloads, giving the operator broad control.

Check

Remind users to download software, especially collaboration and developer tools, only from official vendor sites, and watch for trojanized installers delivered through fake verification pages or paste-into-terminal style lures.

Affected

Users who install trojanized versions of tools like WebEx, Zoom, MobaXterm, or DBeaver; Starland RAT then steals credentials and crypto wallets, maps Active Directory, and gives the attacker persistent machine control.

Fix

Enforce software installation from trusted sources, use application allow-listing, block known indicators, monitor for suspicious HTA and installer activity and Active Directory reconnaissance, and hunt for Starland's persistence and shellcode behaviors.