UAT-11795 Deploys Starland RAT and WLDR Backdoor Through Trojanized Software Installers

Cisco Talos reports a large-scale financially motivated campaign, tracked as UAT-11795, active since June 2025 that distributes trojanized installers (NSIS-wrapped) to deploy a Python-based Starland RAT and a fileless PowerShell WLDR agent; the malware performs extensive reconnaissance, credential and cryptocurrency wallet theft (including deploying CastleStealer and Remcos), persists via scheduled tasks/startup shortcuts, and uses encrypted C2 with a Polygon smart-contract fallback and Telegram-based victim tracking.