RESEARCHERS at Cisco Talos have uncovered a new malware family dubbed Starland RAT that is being spread through fraudulent Zoom installers aimed at cryptocurrency holders in the United States and Europe, according to analysis published by the threat intelligence team.
The infection chain begins with a trojanized installer that drops a Python‑based remote access tool labelled Starland RAT alongside a PowerShell component known as WLDR. No CVE identifier has been assigned to the campaign yet, but the malware showcases a multi‑stage payload designed to harvest credentials and extract cryptocurrency wallet information from infected hosts.
Starland RAT gives attackers interactive shell access, enables file upload and download, and monitors the clipboard for cryptocurrency addresses that can be swapped with attacker‑controlled strings. The WLDR implant handles persistence through registry modifications and establishes a bespoke command‑and‑control channel that can switch to a blockchain‑based mechanism if traditional routes are blocked.
The activity has been tracked from mid‑2025, with UAT‑11795 identified as the Russian‑speaking group behind the operation. Victims are primarily located in the United States and Europe, and the lure extends beyond Zoom to include counterfeit Webex and MobaXterm installers. The campaign is described as financially motivated, focusing on the theft of digital assets rather than espionage.
Defenders should obtain software only from official vendor portals and verify any digital signatures before allowing execution. Enforcing application control policies that block unsigned or unknown installers can prevent the initial drop, while monitoring for unexpected PowerShell or Python processes and outbound connections to unfamiliar domains or blockchain nodes helps detect post‑infection activity.
Keeping endpoint protection solutions current, enforcing network segmentation to limit lateral movement, and sharing observed indicators of compromise with SOC teams are also recommended. Educating users about the risks of phishing and fraudulent update lures reduces the chance of successful social engineering, and administrators may consider disabling Windows Script Host or PowerShell where they are not required for business functions.