Quick Takeaways
- A Russian-speaking threat actor, UAT-11795, uses trojanized software and social engineering to target victims in the US and Europe.
- They employ advanced tools like Python-based Starland RAT and PowerShell WLDR for in-memory exfiltration of credentials, browser data, and cryptocurrency.
- The group hides command-and-control channels within a Polygon smart contract, demonstrating sophisticated, persistent, and covert attack techniques.
Threat, Attack Techniques, and Targets
A new Russian-speaking threat actor, known as UAT-11795, is actively targeting victims in the United States and Europe. This group has been working since June of last year. They often use social engineering to gain access. They trick users into opening a malicious file that downloads trojanized software. Once installed, the malware allows the group to steal credentials, browser data, and cryptocurrency wallets. They use advanced tools like Starland RAT, which is written in Python, and WLDR, a PowerShell-based agent. These tools work in memory, meaning they do not leave many traces, and they use encrypted communication. UAT-11795 even hides a backup command-and-control channel inside a Polygon smart contract. Infections are mostly seen in the U.S. but are also present in Germany, Romania, and Venezuela.
Impact, Security Implications, and Remediation Guidance
The tactics used by UAT-11795 pose serious risks. They can steal sensitive data and cryptocurrencies. Their methods make it harder for traditional security tools to detect them. This campaign shows that attackers are shifting from software vulnerabilities to social engineering and fake software. Organizations should stay alert and exercise caution. They must verify the sources of software and monitor their systems for unusual activity. If infected or in doubt, users should seek advice from security vendors or relevant authorities. It is important to follow proper cybersecurity practices to reduce the risk of infection and data theft.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
