UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

Cisco Talos discloses a financially motivated, Russian-speaking adversary (UAT-11795) conducting a multi-stage campaign since at least June 2025 that uses trojanized installers and HTA/ClickFix social engineering to deploy a Python-based Starland RAT and a PowerShell in-memory C2 implant (WLDR), with additional payloads (CastleStealer, Remcos); the actors target credentials and cryptocurrency wallets, operate distributed C2 and staging infrastructure (including Telegram bots and a Polygon smart-contract fallback), and employ advanced evasion and in-memory execution techniques, with telemetry indicating primary impact in the United States.