Russian Hackers Trojanize WebEx and Zoom Apps to Deploy Starland RAT
What Happened – A financially‑motivated Russian threat group (UAT‑11795) has been distributing trojanized installers for popular collaboration tools—including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT—to deliver the Starland remote‑access trojan. The payload is delivered via a malicious HTA file that drops a disguised NSIS installer, modifies the registry for persistence, and then loads Starland, which harvests browser credentials, cryptocurrency wallets, AD data, and system details.
Why It Matters for Compliance & Audit Readiness
- The attack exploits the trust users place in legitimate software updates, a classic failure of access‑control policies and security‑awareness training that SOC 2 expects organizations to enforce and document.
- Continuous evidence of user‑training completion, privileged‑access reviews, and monitoring of installer integrity are essential audit artifacts to demonstrate that the “Security” (CC6.1) and “Confidentiality” (CC6.2) criteria are being met.
- Leveraging Verisq’s Security Awareness capability helps you capture training records, simulate phishing/installer‑tampering drills, and provide real‑time evidence for SOC 2 auditors.
Who Is Affected – Enterprises that rely on SaaS collaboration platforms (technology/SaaS, finance, healthcare, education, etc.) and any organization whose employees install third‑party tools on corporate endpoints.
Recommended Actions
- Review and tighten installer‑validation controls (code‑signing verification, hash checks) and enforce least‑privilege execution policies.
- Conduct a targeted security‑awareness campaign focused on “trusted‑installer” phishing and the ClickFix technique.
- Map the incident to SOC 2 CC6.1 (Logical Access) and CC6.2 (System Operations) controls, collect training logs, and add them to your continuous‑compliance evidence repository.
Source: BleepingComputer
Technical Notes – The campaign uses an HTA dropper, a trojanized NSIS installer disguised as LICENSE.txt, registry persistence, scheduled‑task creation, and a custom PowerShell C2 framework (WLDR) that queries a Polygon smart contract for fallback domains. Starland loads additional payloads such as CastleStealer (info‑stealer) and Remcos RAT. No specific CVE is cited; the vector is a supply‑chain style installer tampering.