When cybercrime borrows a spy's toolkit: the UAT-11795 campaign hiding inside everyday software- 292

July 18, 2026

A financially motivated, Russian-speaking hacking crew has spent over a year quietly trojanizing the installers of software millions of people use without a second thought — Zoom, Cisco Webex, the developer tool MobaXterm, and even the gaming platform FACEIT — and wrapping around them a toolkit of anti-detection, resilient command infrastructure, and layered malware that would look at home in a state intelligence operation. What makes this campaign worth attention isn't novelty of motive — the group, tracked by Cisco Talos as UAT-11795, is after money, not geopolitics — but the fact that ordinary cybercriminals are now routinely fielding tradecraft that used to be the preserve of nation-states, blurring a line that defenders have long relied on to triage threats by sophistication.

The operation has been running against users across the United States and Europe since at least June 2025, and its choice of targets is deliberately broad rather than industry-specific: developer tools, business collaboration software, and gaming platforms all get the same treatment, suggesting the group is casting as wide a net as possible rather than pursuing one sector. Victims are drawn in through a technique called ClickFix — a trick where the victim is convinced to copy and run a command themselves, believing it will fix some on-screen problem, when in reality it silently downloads and runs a disguised script. That script quietly installs a hidden startup entry so it re-launches every time the victim logs in, while dropping what looks like a normal software installer. Researchers even found a stray Russian-language comment left inside the malware's code, confirming the developers' own language even though they never intended anyone to read that line.

The installer itself is a genuinely clever piece of engineering: it's a real, working copy of the legitimate software, built using a standard installer-creation tool, with one extra file smuggled in — a small program disguised with an innocent name like "LICENSE.txt" so it doesn't draw attention. When the installer runs, that hidden file quietly unlocks and loads the actual malware — a remote-access tool the researchers named Starland RAT — directly into the computer's memory using a simple scrambling technique, while the real software installs normally in the background. The victim sees Zoom or Webex install exactly as expected and has no reason to suspect anything happened underneath.

 Before doing anything else, Starland checks whether it has landed on a real victim's computer or inside a security researcher's testing environment. It compares the computer's username and machine name against known telltale signs used by popular malware-analysis sandboxes, and it checks for a small hidden marker Windows attaches to files downloaded through a web browser — confirming the installer was actually downloaded by a person rather than dropped there directly by an analyst. If anything looks like a trap, the program simply shuts itself down, denying researchers a live sample to study.

Once it's satisfied it's on a genuine target, Starland quietly buries itself deeper — creating a disguised scheduled task and a startup-folder shortcut so it survives a reboot — before it profiles the machine in detail: hardware fingerprint, installed memory, which antivirus is running, and whether the computer belongs to a corporate network. If it does, the malware runs a set of standard Windows commands to map out the internal network and user structure, the same information a network administrator might use to understand their own environment. Separately, it checks for more than forty different types of cryptocurrency wallets, whether stored in a browser extension or a standalone application, takes a screenshot of the desktop, and bundles everything into a single encrypted package before sending it to the attackers.

 The command infrastructure behind this is unusually resilient for a financially motivated crew. The malware first tries to reach a fixed, hardcoded server — but if that server is ever taken down or blocked, it falls back on a second channel hidden inside a public blockchain smart contract on the Polygon network. The malware reads a scrambled instruction from that public, permanent ledger entry, decodes it, and recovers a working backup address — a technique that defeats the usual method of shutting an operation down, since nobody can seize or delete an entry on a public blockchain. On top of that, before it even registers with either server, the malware quietly sends a message to a private messaging-app bot containing the victim's public internet address, computer details, and any cryptocurrency wallets found — and researchers separately discovered the operators' own private channel on that same messaging app, structured like a live dashboard of victims, dated back to the campaign's earliest days.

From this initial foothold, the operators can deploy a second, more advanced tool on demand: an agent the researchers named WLDR, delivered in three separate stages so that no single downloaded piece looks obviously malicious on its own. The final piece runs entirely inside the computer's memory, is written in a scripting language built into Windows itself, and communicates using strong, properly implemented encryption — disguising its network traffic to look identical to an ordinary Chrome browser session. It can run up to ten simultaneous interactive command sessions and streams results back to the attacker in real time, functioning much like a professional remote-support tool, except the attacker's server will only respond to the exact machine it was built for — so anyone trying to probe or scan it from outside gets nothing back.

Two further payloads round out the toolkit. The first, CastleStealer, is built to harvest saved passwords from every major web browser, cryptocurrency wallet browser extensions, session data from the Discord and Telegram apps, and login credentials for the Steam gaming platform — but it checks whether the computer is set to a Russian-language configuration and shuts itself down if so, a deliberate step that suggests the operators are careful not to infect people in their own country. The second, Remcos RAT, arrives through a separate delivery path and is paired with a loader that actively disables two of Windows' own built-in malware-detection hooks by directly altering them in memory, falling back to an alternate method if the first attempt fails, before installing the final payload using techniques designed specifically to avoid leaving traces on the hard drive.

Taken as a whole, UAT-11795 illustrates a trend worth watching closely: financially motivated cybercrime groups adopting the operational patience, layered evasion, and infrastructure resilience once associated almost exclusively with state intelligence services — meaning organizations can no longer assume that "sophisticated" automatically means "state-sponsored," or triage their defenses accordingly.