New Starland RAT and WLDR C2 Implant Power Russian‑speaking Financial Threat Group
Talos reports UAT‑11795, a Russian‑speaking financially motivated group active since June 2025, delivering a novel Python‑based Starland RAT and a PowerShell WLDR memory implant that encrypts beacons and runs payloads. They distribute trojanized installers across developer tools, video‑conferencing and gaming apps, targeting credentials and crypto wallets in the US and Europe.