Campaign Summary
A Russian-speaking criminal group tracked by Cisco Talos as UAT-11795 has been running a continuous campaign since at least June 2025, distributing malware inside trojanized installers for legitimate software: MobaXterm, Cisco WebEx, Zoom, DBeaver Community Edition and the gaming platform FACEIT. The objective is credentials and cryptocurrency assets — purely financial.
The most interesting detail is not the malware but the lure selection. MobaXterm is an SSH/RDP administration terminal. DBeaver is a database management client. This is software used by the people holding the highest privileges in an environment, not by ordinary office staff. An infected administrator workstation hands the attacker immediate Active Directory reconnaissance, database credentials and live operational sessions.
The campaign deploys two previously undocumented malware families: Starland RAT, a Python-based tool executed in memory, and the WLDR agent, a fully fileless PowerShell C2 implant. Both act as launch platforms for CastleStealer and Remcos RAT.
Victims are concentrated in the United States, with smaller clusters in Germany, Romania and Venezuela. Priority action: sweep every endpoint for pythonw.exe executing a .txt file as its argument.
Victimology and Lure Set
Campaign victimology map (source: Cisco Talos).
Talos assessed victim distribution from telemetry and passive DNS resolution data for the campaign's C2 domains. The trojanized installer set:
| Trojanized installer |
Original software |
Target user group |
MobaXterm_v26.1.exe |
MobaXterm |
Sysadmins, network engineers |
WebEx_Client.exe, Zoom installer |
Cisco WebEx, Zoom |
Enterprise employees |
dbeaver-ce-windows-x86_64.exe |
DBeaver Community Edition |
DBAs, developers |
FaceitInstaller_x64.exe |
FACEIT |
Gamers |
The spread across developer tooling, IT administration utilities, enterprise collaboration platforms and a consumer gaming application points to an opportunistic, volume-driven distribution model rather than a single vertical — but it happens to land squarely on the highest-privilege account population in most organisations.
Timeline
| Date |
Event |
| 5 June 2025 |
Private Telegram channel "stuk komanda" created — earliest confirmed evidence of actor activity |
| From June 2025 |
Trojanized installer distribution targeting users in the US and Europe |
| ~June 2026 |
Elastic Security Labs documents CastleStealer in an unrelated campaign (OXLOADER loader, fake Node.js Google Ads) |
| 16 July 2026 |
Cisco Talos publishes the full technical report on UAT-11795, Starland RAT and WLDR C2 |
This is an actor activity timeline based on public reporting, not the timeline of a specific incident response engagement.
Kill Chain
Infection chain summary (source: Cisco Talos).
The victim is socially engineered into running a command on their own machine, most likely via a ClickFix lure (Talos could not confirm the initial vector with hard evidence).
That command invokes mshta.exe to fetch and execute an HTA file hosted on attacker infrastructure.
The HTA runs embedded VBScript that drops a Windows batch file into the user profile's temporary folder.
The batch file downloads the trojanized installer from a staging domain and executes it.
In parallel, the VBScript writes HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name MyApp, pointing at mshta.exe to re-fetch the remote HTA at every logon.
The batch file sends a notification beacon to an attacker-controlled Telegram bot confirming successful execution.
The NSIS installer launches the bundled pythonw.exe runtime with LICENSE.txt as its argument — in reality compiled Python bytecode.
The Python loader XOR-decrypts (key 0xC6) its embedded payload and loads Starland RAT directly into memory.
Starland RAT runs its anti-analysis checks and terminates immediately if a sandbox is detected.
The RAT establishes persistence via a scheduled task and a Startup folder LNK, then attempts UAC elevation.
The RAT collects system information, Active Directory data, a desktop screenshot and a cryptocurrency wallet inventory.
The RAT beacons the victim profile to the Telegram bot, then registers the host with the primary C2.
If the primary C2 fails, the RAT queries a Polygon smart contract to resolve a fallback domain.
The RAT polls C2 every 50–60 seconds and receives one of four commands, branching into three payload paths:
x64 shellcode → CastleStealer
x32 shellcode → Remcos RAT
shellexecute → a curl command fetching the WLDR C2 PowerShell stager
Technical Analysis
Initial Vector: HTA and VBScript
The weaponized HTA that downloads and executes trojanized installers (source: Cisco Talos).
Nothing in the opening stage is technically novel — mshta.exe has been an abused LOLBIN for years — but the sequencing is worth noting: persistence is written before the payload actually runs, and that persistence points at an HTA on attacker infrastructure rather than a file on disk. The attacker can swap the payload at any time without touching the victim machine again; conversely, once the domain is taken down the persistence entry becomes inert.
Talos recovered a Russian-language developer comment left inside the VBScript: Добавление команды в автозапуск для текущего пользователя ("Adding the command to autorun for the current user"). This underpins the Russian-speaking actor assessment.
NSIS Installers and the Python Loader
The actor repackages legitimate installers using the Nullsoft Scriptable Install System. Inside the package they bundle the pythonw.exe runtime alongside a compiled Python file named LICENSE.txt so it reads as an ordinary licence document. The NSI script is modified to invoke the runtime against that file during installation.
Snippet of the decompiled Python loader (source: Cisco Talos).
The loader is unusually large, padded with junk functions performing random arithmetic and printing random strings to stdout. The real logic occupies six lines: XOR-decrypt the embedded payload with key 198 (0xC6), then execute Starland RAT in memory. This is obfuscation aimed at human analysts and entropy-scoring tooling, not at signatures.
Starland RAT
On startup the RAT resolves and declares every required Windows API signature through Python's ctypes interface, loading kernel32.dll directly via WinDLL and explicitly defining argument and return types for each call: VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, VirtualProtectEx, CreateProcessA, QueueUserAPC, ResumeThread. Every later injection operation therefore needs no further imports or dynamic resolution, shrinking the surface available for hooking.
Anti-analysis, three layers:
The logged-on username is compared against a hardcoded list of sandbox service accounts including WDAGUtilityAccount
The computer name is compared against known hostnames from Cuckoo, Any.Run, Joe Sandbox and Hybrid Analysis
The Zone.Identifier alternate data stream on the installer in the Downloads folder is checked, confirming the file arrived via a browser download rather than being copied onto an analysis machine That third check is the one worth internalising. It repurposes Mark-of-the-Web — a mechanism built to protect users — into a genuine-victim validation signal.
Persistence: the RAT creates a scheduled task via New-ScheduledTask with a randomised name matching PythonLauncher-{3 random characters}. Under administrator privileges the trigger is AtLogOn with RunLevel Highest. A secondary Startup folder LNK is created through the WScript.Shell COM object, targeting pythonw.exe with LICENSE.txt as its argument. If not already elevated, the RAT attempts UAC elevation via ShellExecuteW with the runas verb.
Reconnaissance: HWID, total RAM and installed antivirus products:
Get-CimInstance -Class Win32_ComputerSystemProduct.UUID
wmic memorychip get Capacity
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct
If the host is domain-joined (Get-WmiObject Win32_ComputerSystem.Domain), the RAT escalates to Active Directory reconnaissance:
whoami && systeminfo && net user {USERNAME} /dom && nltest /dclist
Workgroup-only hosts get whoami /all. The RAT also captures a desktop screenshot, saves it as PNG, Base64-encodes it in memory and then deletes the PNG from disk — a small anti-forensics touch that defeats slower collection workflows. It additionally enumerates more than 40 cryptocurrency wallets across desktop applications and browser extensions.
Everything is consolidated into a single JSON file, XOR-encrypted with the five-byte key helo1, Base64-encoded, and sent by HTTP POST with a spoofed Chrome 138 User-Agent.
Starland RAT's Telegram bot beaconing function (source: Cisco Talos).
Before C2 registration the RAT messages the Telegram bot using hardcoded credentials, including the public IP (from api64.ipify[.]org), build name, region locale, computer name presented as a "Crew ID" field, OS platform and release, processor string, and a hardcoded "Windows Defender" protection label. Detected wallets are appended. In practice this means the operator knows what wallets a host holds before that host even appears in the C2 panel — victim triage by value, from the first second.
C2 protocol: after registration the RAT sends a GET every 50–60 seconds carrying minimal JSON with two randomly named junk fields and the bot identifier, using the same helo1 XOR plus Base64.
| Command |
Action |
shellexecute |
Runs an arbitrary shell string via cmd /c or PowerShell, returning output to C2 over HTTP POST |
x32 |
Receives a 32-bit shellcode URL and executes it via APC process injection |
x64 |
Receives a 64-bit shellcode URL and executes it via APC process injection |
download |
Downloads a payload to %TEMP% and executes it by extension (EXE, MSI, DLL, ZIP) |
| HTTP 403 response |
Kill switch — the RAT self-deletes and exits |
The HTTP status-code kill switch matters operationally: a proxy or sinkhole configuration that returns 403 can cause the sample to destroy itself before you have collected it.
Blockchain-Anchored Fallback C2
If primary registration fails, the RAT issues an eth_call over JSON-RPC to the public polygon-rpc[.]com endpoint, targeting smart contract 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba with function selector 0xc659f3b8. The returned hex string is XOR-decrypted with the key $m7*rYpry3 to recover a fallback domain.
Functionally this is a dead drop resolver, but hosted on a distributed ledger that cannot be taken down and reached through entirely legitimate public RPC infrastructure. Traffic to polygon-rpc[.]com from a finance department workstation is not normal — and that is precisely the detection opportunity.
The WLDR C2 Framework
When the operator wants interactive access rather than bulk data collection, they issue a shellexecute command running curl to pull the WLDR PowerShell chain — named after the internal project designation the actor left in their own scripts.
Stager: the first-stage script sets up a loop counter and two boolean state flags, creates runtime aliases for command execution, resolves .NET Base64 and byte conversion types through obfuscated string construction, and XOR-decrypts the next stage with a dynamically computed key.
Snippet of the WLDR PowerShell downloader (source: Cisco Talos).
Downloader: the sharpest piece of design in the campaign. The script derives a hardware identifier from the C: drive volume serial number, converts it from hex to decimal and appends it to two hardcoded C2 URLs. The C2 server responds only to requests whose HWID matches a pre-registered value. The consequences are immediate: you cannot detonate the sample in a sandbox and retrieve the next stage, you cannot replay captured traffic, and automated analysis pipelines stop dead at this point. This is anti-investigation, not anti-detection.
The C2 response is an encrypted JSON envelope containing a Base64 salt, IV, ciphertext and authentication tag. The downloader derives a 64-byte key from the hardcoded plaintext password odg5t8mvssvh plus the salt, decrypts the WLDR agent, and writes the C2 URL and password into PowerShell global scope for the agent to inherit.
Agent: a full-featured PowerShell client running entirely in memory:
Mutex f2j398fj239d8j23dkkskskkkkkkkkk prevents duplicate instances
AES-256-CBC with HMAC-SHA256 in an encrypt-then-MAC construction, session keys derived via PBKDF2-SHA256 over a random salt at 5,000 iterations, a fresh IV per message, and the protocol version tag WSv1 bound into every MAC computation
WMI reconnaissance covering antivirus products, network adapter configuration, OS version and build, domain membership, CPU, RAM, administrative privilege status and UAC policy
Polls C2 every 10 seconds over HTTPS with headers mimicking a Chrome 124 session
Primary execution engine is a RunspacePool supporting up to 10 concurrent threads, with event handlers registered on output, error and warning streams that forward results to C2 in real time rather than waiting for script completion
If Runspace initialisation fails, it falls back to PowerShell background jobs, collecting output only after completion Real-time output streaming tells you what this tool is for: interactive operations where the operator types and watches results flow back, like a genuine shell — not a bot running scheduled batch tasks.
Shellcode Loader and Final Payloads
Shellcode snippet performing the AMSI bypass (source: Cisco Talos).
The shellcode loader, shared across x64 and x32 variants, resolves all Windows APIs at runtime by enumerating loaded modules in memory, walking each module's export directory and comparing hashed function names against stored values — no API string exists in plaintext.
Before decrypting its payload, the shellcode neutralises both AMSI and ETW: it resolves AmsiScanBuffer in amsi.dll and EtwEventWrite in ntdll.dll, then overwrites their first bytes so AMSI always returns a clean scan result and the ETW write function returns immediately. If direct patching fails, a fallback path calls VirtualProtect to flip the target page to RWX, writes the same patch bytes, and restores the original protection.
The payload is then decrypted, LZX-decompressed into a freshly allocated region, and dispatched via reflective PE injection, .NET CLR loading through the ICorRuntimeHost COM interface, or a PowerShell Runspace, depending on payload type.
CastleStealer (x64 branch) is a .NET infostealer. It checks for a Russian locale and exits on a match, and carries a hardcoded build expiry timestamp limiting its operational window. Its theft surface covers the full Chromium browser family and Firefox via direct SQLite database access, with decryption support for both legacy DPAPI-protected credentials and the newer AES-GCM app-bound encryption scheme. Beyond credentials it enumerates crypto wallet extensions, Discord and Telegram session files, Steam credentials and targeted filesystem paths, exfiltrating over a TCP socket.
Remcos RAT (x32 branch) is a commercial tool sold openly since 2016, providing real-time keylogging, screen and webcam capture, audio recording, file management, shell execution and clipboard monitoring.
The Wider Picture: Loaders Change, Payloads Don't
Three threads explain why this campaign should not be read in isolation.
Remcos is the constant of the decade. In February 2024, Morphisec documented a UAC-0184 campaign against a Ukrainian entity based in Finland: IDAT Loader (which shares code with Hijack Loader) concealed the Remcos payload inside the IDAT chunk of a PNG file, decrypting and executing it in memory with injection into explorer.exe and PLA.dll. Two years later UAT-11795 delivers the same Remcos — just hidden in x32 shellcode inside an NSIS installer. Loaders churn constantly; commercial payloads do not, because they are cheap, stable and require no development capability.
CastleStealer is not a private arsenal. On 19 June 2026, Elastic Security Labs published OXLOADER, a previously undocumented loader delivering CastleStealer through malicious Google Ads impersonating the Node.js download page, using DonutLoader to execute the payload entirely in memory. CastleStealer had already been observed alongside CastleLoader in the BackgroundFix campaign. UAT-11795 loading the same stealer confirms a shared payload ecosystem: one stealer, three loaders, multiple unrelated operators. Hunting by malware family name will always lag behind hunting by behaviour.
The same defensive paradox, twice. In 2024 the payload lived in the pixels of a PNG the user never saw. In 2026 it lives in RAM and in a Polygon smart contract. Both place the payload where file-scanning tooling does not look. The WLDR chain goes a step further by binding its payload to one specific victim's disk serial, making sample acquisition impossible even when you hold every network indicator.
Indicators of Compromise
All indicators are taken from the official Cisco Talos IOC repository. Domains and IPs are defanged. Re-fang only inside controlled environments (MISP, VirusTotal, SIEM).
File hashes (SHA-256)
# Trojanized installers
6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6 MobaXterm_v26.1.exe
6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d WebEx_Client.exe
1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6 FaceitInstaller_x64.exe
ddcf66ecc61dc6b8cd36748d284d8cb45a470201b5373dd2bfc47700c7da32e1 dbeaver-ce-windows-x86_64.exe
603fd9724de346a06e00c1b8502c2ac1180812a18bbf30032dab8d469e5c18e1 dbeaver_ce_windows_x86_64.exe
f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14 Zoom Installer
# HTA downloaders
2c7a99f137efd718f89cf8b260379c99af89ea1939568df09314918f2c5999a3
5b9bf7957a9f8869c87ace1a6d76b48e2623073e72739ad0636b5dfa4bb2e0c3
7dc77a5abab119960fbe42b1535c957020cce1b8e0a3cf58d4eddc51b5bf9940
36e3838d07978f49ebe6546d57d2f311b8d6566558bcd58448e921c988cc346a
575ce92c473e6d47810321e309a4e29dd7f52f4152526b0bdca80f54b53aed2f
964256d3259b6e0c701ec04116c45cf0ec381c1c209dc29b09a7930cd7a4810b
a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9
# Batch, archive, loader
a32ac345e39cb7606322e2155bd7b4d6941c1678619e48d1f14d9301ee53e6c0 Win_Batch
2751281d3800d82ecd3fad7c1d2293f3b947875a343b0672b4f4024a261165d2 Plugins.7z
47dedb08385449d48d8b6543030310317c92cddafa25e14ee0cb9a32d53ced5c Python_Loader.py
162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca Starland RAT
# WLDR PowerShell chain
451ac8ca34d5bcdfe476465f69eb517b2608f267c7e8d69f8ef36197a6f1d949 Stage-1-obfuscated-1.ps1
365024336c7681ac0854321ac6c140a245b9593285da02d2a590124cdc592370 Stage-1-obfuscated-2.ps1
a080b5380ccc8fc40b24c02151d305efc32d931dc547881e01a2e6f2b070c7dc Stage-1-obfuscated-3.ps1
17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e Stage-1.ps1
f8da52ff98e66b137b5d31908f0a5d0fa1eb446034337f8bba3d5bba60f586be Stage-2.ps1
d52540621dec5ed56cac8532f0e4fe10a7575c3e17e984f59646909fa587dd35 WLDR-agent-payload.ps1
a59742d3086924c5f511d248df01601bfbf723359590fb3f3ba355f2792cc455 PS-Stage-3-JSON.json
# Shellcode and final payloads
2a27b3415114b874da295c19cce5227a8b8d9525cc2da331034a1f45528eecae ShellcodeX64-starlandfox.bin
1b46f761719dce44baa2d7b417c5214fc41c080f7f9ba485e7e489d949097f1f ShellcodeX32-x32remka.bin
896185a89bd7eb0520b03fdcfb8db0be98b43cf15f14041d73b23d3988c1bcab CastleStealer
a1835d333ac3db961a8ff1f4864e3c10a6f73a872c040599091390a009ac7804 remcosRAT
Domains
eorthopaedics[.]com # staging + C2 (/feed/) — likely hijacked legitimate domain
sastoro[.]com # parallel C2 (/alpha/)
zynaris[.]io # hosts HTA stager and trojanized installers
web-devtools[.]com # hosts raw shellcode payloads
aipythondevs[.]com # primary Starland RAT C2
windowscreenrepairnearme[.]com # primary Starland RAT C2 — likely hijacked legitimate domain
alphabitcapital[.]info
niggerdemon[.]in
IP addresses
104.248.233[.]104
192.81.216[.]250
74.114.119[.]201
178.255.126[.]39
193.149.176[.]254
185.238.191[.]234
URLs
hxxps://eorthopaedics[.]com/feed/note
hxxps://eorthopaedics[.]com/feed/cew78zwvd2/
hxxps://eorthopaedics[.]com/feed/gnsmetadyx54/
hxxps://sastoro[.]com/alpha/nrpilqjnut/
hxxps://sastoro[.]com/alpha/dpyb8w3ycih8/
hxxps://web-devtools[.]com/starlandfox
hxxps://web-devtools[.]com/x32remka
hxxps://web-devtools[.]com/dopfile
hxxps://web-devtools[.]com/file.zip
hxxps://windowscreenrepairnearme[.]com/command
Host-based artifacts
# Registry Run key
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp -> mshta.exe <remote HTA URL>
# Scheduled task
PythonLauncher-{3 random characters} (AtLogOn, RunLevel Highest)
# Startup folder
LNK targeting pythonw.exe with LICENSE.txt as argument
# File
LICENSE.txt (compiled Python bytecode, alongside pythonw.exe)
# Mutex (WLDR agent)
f2j398fj239d8j23dkkskskkkkkkkkk
Other artifacts
# XOR keys
0xC6 (198) - Python loader decrypting Starland RAT
helo1 - Starland RAT C2 data encoding
$m7*rYpry3 - fallback domain decryption from smart contract
# WLDR session password
odg5t8mvssvh
# Smart contract (Polygon)
0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba (function selector 0xc659f3b8)
RPC endpoint: polygon-rpc[.]com
# Telegram bot IDs
8384531459 (skuefq_bot)
7993597060 (komandastuk_bot)
# User-Agent (Starland RAT)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Cisco coverage
ClamAV: Txt.Downloader.Agent-10060312-0, Html.Downloader.Agent-10060313-0,
Html.Downloader.Agent-10060314-0, Py.Loader.Agent-10060315-0,
Py.Loader.Agent-10060316-0, Ps1.Trojan.Agent-10060317-0,
Ps1.Trojan.Agent-10060318-0, Ps1.Trojan.WLDRAgent-10060319-0,
Ps1.Downloader.Agent-10060320-0, Win.Trojan.CastleStealer-10060341-0,
Win.Trojan.Starland_Installer-10060342-0, Win.Malware.Starland-10060343-0,
Win.Malware.Remka-10060344-0
Snort SIDs: 66787 - 66790, 301580
MITRE ATT&CK Mapping
| Tactic |
Technique ID |
Technique Name |
Observed in campaign |
| Initial Access |
T1566 |
Phishing |
ClickFix lure (not hard-confirmed) |
| Execution |
T1204.002 |
User Execution: Malicious File |
Victim runs trojanized installer |
| Execution |
T1218.005 |
System Binary Proxy Execution: Mshta |
mshta.exe fetching remote HTA |
| Execution |
T1059.001 |
Command and Scripting Interpreter: PowerShell |
WLDR chain, recon commands |
| Execution |
T1059.003 |
Windows Command Shell |
Batch file, cmd /c |
| Execution |
T1059.005 |
Visual Basic |
VBScript inside the HTA |
| Execution |
T1059.006 |
Python |
Loader and Starland RAT |
| Persistence |
T1547.001 |
Registry Run Keys / Startup Folder |
MyApp key, Startup LNK |
| Persistence |
T1053.005 |
Scheduled Task |
PythonLauncher-{xxx} |
| Privilege Escalation |
T1548.002 |
Bypass User Account Control |
ShellExecuteW with runas |
| Defense Evasion |
T1497.001 |
Virtualization/Sandbox Evasion: System Checks |
Sandbox username and hostname lists |
| Defense Evasion |
T1562.001 |
Impair Defenses: Disable or Modify Tools |
Patching AmsiScanBuffer, EtwEventWrite |
| Defense Evasion |
T1036.005 |
Masquerading: Match Legitimate Name or Location |
Payload named LICENSE.txt |
| Defense Evasion |
T1027 |
Obfuscated Files or Information |
Junk functions, XOR, PowerShell obfuscation |
| Defense Evasion |
T1140 |
Deobfuscate/Decode Files or Information |
XOR 0xC6, AES envelope |
| Defense Evasion |
T1620 |
Reflective Code Loading |
Reflective PE injection, ICorRuntimeHost |
| Defense Evasion |
T1070.004 |
Indicator Removal: File Deletion |
Screenshot deletion, self-delete on HTTP 403 |
| Defense Evasion |
T1055.004 |
Process Injection: APC Injection |
x32 and x64 commands |
| Discovery |
T1082 |
System Information Discovery |
HWID, RAM, OS, processor |
| Discovery |
T1016 |
System Network Configuration Discovery |
WLDR agent adapter enumeration |
| Discovery |
T1087.002 |
Account Discovery: Domain Account |
net user {USERNAME} /dom |
| Discovery |
T1018 |
Remote System Discovery |
nltest /dclist |
| Discovery |
T1518.001 |
Software Discovery: Security Software Discovery |
AntiVirusProduct WMI query |
| Collection |
T1113 |
Screen Capture |
Desktop capture, Base64 staging |
| Credential Access |
T1555.003 |
Credentials from Password Stores: Web Browsers |
CastleStealer |
| Credential Access |
T1539 |
Steal Web Session Cookie |
Discord, Telegram, Steam sessions |
| Command and Control |
T1071.001 |
Application Layer Protocol: Web Protocols |
HTTP/HTTPS beaconing |
| Command and Control |
T1102.001 |
Web Service: Dead Drop Resolver |
Polygon smart contract, Telegram bots |
| Command and Control |
T1573.001 |
Encrypted Channel: Symmetric Cryptography |
XOR helo1, AES-256-CBC + HMAC |
| Command and Control |
T1105 |
Ingress Tool Transfer |
curl stager fetch, download command |
| Impact |
T1657 |
Financial Theft |
Cryptocurrency wallet theft |
[NEEDS VERIFICATION] — recent ATT&CK versions map the ClickFix technique to T1204.004 (User Execution: Malicious Copy and Paste). Confirm against the ATT&CK version your organisation standardises on before building a Navigator layer.
Assessment
There is no zero-day here. Every component is documented technique: mshta, NSIS, XOR, APC injection, AMSI patching. But judging sophistication by zero-day presence is an outdated lens. What stands out about UAT-11795 is how much of the design budget went into anti-investigation rather than anti-detection.
Consider three architectural choices: binding the WLDR payload to one machine's disk serial; storing the fallback domain in a smart contract; checking Zone.Identifier to reject samples copied onto an analysis box. None of these helps the malware slip past EDR. All three exist to ensure that once you have detected it, you still cannot fully analyse it or dismantle the infrastructure. That is the signature of a group that has lost to defenders a few times and adjusted.
On the initial vector, ClickFix left the "emerging technique" category some time ago. The Microsoft Digital Defense Report 2025 places it at 47% of observed initial compromises, ahead of traditional phishing. The ESET Threat Report H1 2026 measured 108% growth between H2 2025 and H1 2026, alongside the emergence of AI-fix, CrashFix and ConsentFix variants. It works because it does not exploit software — it exploits the user's instinct to fix their own problem, and there is no patch for that.
For organisations in Vietnam, two points concern us more than the campaign itself.
The first is software acquisition habits. MobaXterm, DBeaver, WinSCP, Notepad++ — the daily toolkit of infrastructure engineers — are routinely pulled from the first search result or from a link shared in an internal chat group rather than the vendor's own site. For software outside the asset management catalogue there is usually no mechanism checking digital signatures or checksums at all. This campaign needed no vulnerability to exploit that.
The second is the blast radius when an administrator workstation is hit. Starland RAT runs nltest /dclist and net user /dom during initial reconnaissance. On an office worker's machine, that yields a domain controller list. On a sysadmin's machine holding live sessions to multiple systems, it yields an infrastructure map plus database administration credentials. In many operating models we encounter, the administrator workstation is also the least monitored asset in the estate, because alerts originating from it get dismissed as routine operational activity and progressively whitelisted.
One last detection point, and the cheapest one available: pythonw.exe executing a .txt file is behaviour that is almost never legitimate. It requires no complex rule, generates no noise, and sits at exactly the chokepoint the entire infection chain has to pass through.
Recommendations
Block immediately: push the IOC domains and IPs to firewall and DNS controls, and add polygon-rpc[.]com and other public blockchain RPC endpoints to monitoring unless your organisation has a legitimate business use for them.
Hunt for pythonw.exe processes taking a .txt argument, Run keys named MyApp pointing at mshta.exe, and scheduled tasks matching PythonLauncher-* across the estate.
Enforce software sourcing policy: standardise download sources for administration tooling (MobaXterm, DBeaver, SSH and DB clients), mandate digital signature verification, and prioritise application allowlisting on sysadmin and DBA workstations.
Enable PowerShell Script Block Logging and Module Logging and ship them to the SIEM — the WLDR implant is memory-only, and this is the only evidence that survives a reboot.
Treat administrator endpoints as server-tier assets: full monitoring, no habitual whitelisting, and separation of administrative accounts from workstations also used for email and web browsing.
If compromise is suspected: isolate the host from the network, capture a memory image before powering down, and rotate all credentials from a separate clean device — stolen session cookies and tokens remain valid after a password change unless sessions are explicitly revoked.
References
