---
title: "Discussion on \"UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant\" | Hashnode"
description: "Discussion on \"UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant\". Campaign Summary\nA Russian-speaking criminal group tracked by Cisco Talos as UAT-11795 has been running a continuous campaign since at least June 2025, distributing malware inside trojanized installer"
url: "https://hashnode.com/posts/uat-11795-trojanized-webex-zoom-and-mobaxterm-installers-deliver-starland-rat-and-the-wldr-implant/6a6871d251644b38f9601119"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant](https://blog.fiscybersec.com/uat-11795-trojanized-webex-zoom-and-mobaxterm-installers-deliver-starland-rat-and-the-wldr-implant?utm_source=hashnode&utm_medium=feed)

Campaign Summary A Russian-speaking criminal group tracked by Cisco Talos as UAT-11795 has been running a continuous campaign since at least June 2025, distributing malware inside trojanized installer

Jul 28 · 21 min read · blog.fiscybersec.com  
Read the article

-   [#uat-11795](https://hashnode.com/tag/uat-11795)
-   [#starland-rat](https://hashnode.com/tag/starland-rat)
-   [#wldr](https://hashnode.com/tag/wldr)
-   [#castlestealer](https://hashnode.com/tag/castlestealer)
-   [#remcos-rat](https://hashnode.com/tag/remcos-rat)
-   [#clickfix](https://hashnode.com/tag/clickfix)
-   [#trojanized-installer](https://hashnode.com/tag/trojanized-installer)
-   [#nsis](https://hashnode.com/tag/nsis)
-   [#amsi-bypass](https://hashnode.com/tag/amsi-bypass)
-   [#blockchain-c2](https://hashnode.com/tag/blockchain-c2)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)

## Written by

[Vũ Nhật Lâm](https://hashnode.com/@kami61)

@kami61

  
[View profile](https://hashnode.com/@kami61)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.