New Russian Campaign Uses Fake Webex and Zoom Installers to Deploy Starland RAT

**Executive summary:** Cisco Talos disclosed a Russian-speaking financially motivated campaign (UAT-11795) that spreads trojanized installers for tools like MobaXterm, Webex, Zoom and others to deploy Starland RAT (Python), the WLDR in-memory PowerShell implant, and additional payloads (CastleStealer, Remcos); the malware uses stealthy anti-analysis checks, persistent scheduled tasks, extensive reconnaissance and credential/wallet theft, and resilient C2 using both hardcoded domains and a Polygon smart-contract fallback with Telegram-based notifications.