Fake Webex & Zoom Installers Used by Russian Campaign to Deploy Starland RAT
What Happened — Russian‑speaking threat group UAT‑11795 has been distributing trojanized installers for popular collaboration tools (Webex, Zoom, MobaXterm, etc.) that silently drop the Starland remote‑access trojan and a memory‑only WLDR implant. The initial foothold is gained via a “ClickFix” social‑engineering flow that convinces victims to run a malicious HTA file, which then installs the fake package and persists via a Run‑key registry entry.
Why It Matters for Compliance & Audit Readiness
- The attack exploits weak access‑control verification and lack of security‑awareness among end users – exactly the scenario SOC 2’s CC6.1 (Logical Access) and CC7.1 (System Operations) controls are designed to prevent and evidence.
- Continuous monitoring of installer integrity and user‑training metrics provides defensible audit evidence that your organization enforces “least‑privilege” and “secure configuration” policies.
- Mapping this incident to SOC 2 readiness highlights gaps in security‑awareness training and software‑allowlist processes, which can be closed with Verisq’s Security Awareness capability.
Who Is Affected — Technology & SaaS vendors, enterprise IT departments, developers, and any organization that allows end‑user installation of collaboration or development tools (e.g., finance, healthcare, education).
Recommended Actions
- Verify code‑signing of all installers; enforce application allow‑listing and hash‑based validation.
- Update SOC 2 access‑control policies to require multi‑factor authentication for any installer execution on privileged workstations.
- Conduct targeted security‑awareness training that covers “fake installer” social engineering and the ClickFix technique.
- Enable continuous monitoring of registry Run‑key changes and HTA execution events; retain logs as audit evidence.
Source: Security Affairs
Technical Notes
- Attack vector: Phishing‑style ClickFix HTA → trojanized NSIS installer → Starland RAT (Python) & WLDR (PowerShell, memory‑only).
- Payload capabilities: credential theft, crypto‑wallet enumeration, remote command execution.
- No public CVE; the vulnerability is the malicious repackaging of legitimate installers.
Source: Cisco Talos Report