Cisco TalosPublished
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
By Alex Karkins
Excerpt
Thursday, July 16, 2026 06:00
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
Talos has discovered that the actor in this campaign delivers a Python-based remote access tool (RAT) that we track as “Starland RAT” and a command-and-control (C2) memory implant known as the “WLDR agent.”
The WLDR agent is a sophisti…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Cisco Talos on blog.talosintelligence.com.
Mentioned in the excerpt
More from Cisco Talos7
- The Closed Quorum: Inside the first reported autonomous AI C2 implantCisco Talos · Published 22 Sep
- UAT-7810 continues building ORB networks using new malwareCisco Talos · Published 7 Jul
- New Dohdoor malware campaign targets education and health careCisco Talos · Published 26 Feb
- UAT-8302 and its box full of malwareCisco Talos · Published 5 May
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
