Threat Analysis · Content Analysis, Disarm and Reconstruction
Cisco Talos has disclosed a financially motivated intrusion set it tracks as UAT-11795, a Russian-speaking group that has been active since at least June 2025 and has focused on victims in the United States and Europe, with additional cases seen in Germany, Romania, and Venezuela. The campaign is a clear example of how today’s cybercriminals combine custom malware with carefully staged delivery to slip past traditional endpoint defenses.
The operation relies on two homegrown tools. The first is a Python-based remote access tool that Talos calls Starland RAT. The second is a PowerShell command-and-control implant known as the Cisco Talos has disclosed a financially motivated intrusion set it tracks as UAT-11795, a Russian-speaking group that has been active since at least June 202, which runs entirely in memory, uses encrypted beaconing, and ties each payload to the hardware of the machine it lands on. The group also keeps CastleStealer and Remcos RAT on hand as alternate payloads. Its goal is straightforward: steal credentials and cryptocurrency wallet assets, then hold a durable connection back to the victim.
For security leaders, the more useful lesson is not the arrival of another remote access tool. It is the continued industrialization of initial access. Powerful post-compromise tooling has become almost ordinary. The real advantage for attackers now lies in reaching the endpoint undetected before any of that tooling ever runs.
Custom Malware Built for the Long Game
Talos attributes the campaign to a group that has invested in its own tooling rather than leaning only on off-the-shelf malware. Instead of a publicly available RAT, the operators wrote Starland RAT to run commands, manage files, gather system and Active Directory information, harvest browser data, and interact directly with the machines they control.
Alongside it sits the WLDR agent, a lightweight in-memory implant that talks to attacker infrastructure while leaving a very small footprint. Keeping the command-and-control function separate from the RAT gives the operators flexibility. They can swap communication channels or replace parts without rebuilding the whole toolset. It also makes detection harder, because defenders may only ever see one piece rather than a single recognizable family.
The pattern is familiar across financially motivated groups. Malware development now looks a lot like commercial software engineering. Parts are modular, purpose-built, and designed to be replaced quickly the moment detection rates start to climb.
Initial Access Is Still the Decisive Stage
However capable the malware is, neither Starland RAT nor the WLDR agent simply appears on a victim’s computer. Every successful compromise still depends on getting that first file to run.
In this campaign the lure is trojanized installers for well-known software, including MobaXterm, WebEx, Zoom, DBeaver, and FaceIT. Talos assesses that the files are likely pushed using the ClickFix technique, where a user is tricked into running an attacker’s command. From there the chain begins with an HTA file that pulls down a tampered NSIS installer, which hides a Python loader disguised as a harmless text file named LICENSE.txt.
Once that first payload runs, the rest of the attack gets much easier. The loader retrieves additional components, persistence is installed, command-and-control channels open, and an attempted intrusion becomes an active compromise. This is the distinction that matters most for defenders. Endpoint detection and response tools are good at spotting malicious behavior after execution has already started, but by that point the attacker usually has enough of a foothold to begin stealing credentials, moving laterally, or digging in for the long term. The best chance to stop the attack is before any malicious code is allowed to run at all.
Why Custom Malware Keeps Getting More Common
Starland RAT is not a one-off. Generative AI, ready-made development frameworks, and modular coding practices have sharply lowered the cost of producing brand-new malware families. Rather than endlessly tweaking an existing sample to dodge detection, attackers now spin up entirely new implants that behave alike but look very different at the binary level.
That shift undercuts approaches built purely on signatures and known samples. As new implants get cheaper to make, organizations should expect more campaigns built around unique loaders, bespoke command-and-control tools, and fast-changing payloads that carry no history and no reputation for defenders to lean on.
Prevention Before Execution Changes the Math
This is exactly where Content Analysis, Disarm and Reconstruction technology earns its place. Rather than trying to decide whether a given malware family is already known, CADR examines the structure and the active content inside an incoming file. Scripts, embedded executables, malicious objects, exploit-bearing structures, and hidden payloads can be identified and stripped out before a user ever opens the file.
Follow that logic through this campaign. If the weaponized installer never reaches the endpoint in a form that can execute, Starland RAT is never downloaded. If the embedded loader is removed before delivery, the Python stager never launches. If the active content cannot run, the WLDR agent never establishes communications. Unlike endpoint products that mostly react after execution has begun, CADR works upstream, keeping malicious content out of the trusted environment in the first place.
For a campaign like UAT-11795 that architectural difference is significant. The custom RAT, the in-memory C2 implant, the persistence, and the remote control all depend on that first successful execution. Remove the weaponized content at the file level and the rest of the chain never has a chance to form.
The Executive Takeaway
UAT-11795 reinforces a pattern security leaders have watched build throughout 2026. Attackers keep investing in custom malware because generating new implants is faster, easier, and cheaper than trying to outrun mature detection. Yet no matter how novel the malware becomes, every campaign still needs a way in.
Organizations that focus only on catching malware after it runs will keep facing an endless stream of freshly built payloads. Those that stop malicious files from executing in the first place move the fight to a stage where attackers have far fewer moves left. As bespoke families like Starland RAT become the norm, prevention at the point of content ingestion is shifting from a nice-to-have into a foundational part of enterprise cyber resilience.