The PolySwarm Blog

Verticals Targeted: Cryptocurrency
Regions Targeted: United States, Germany, Romania, Venezuela
Related Families: Starland RAT, WLDR Framework, Remcos RAT, CastleStealer

Executive Summary

Industry researchers identified a financially motivated, Russian-speaking threat actor tracked as UAT-11795 conducting a sophisticated malware campaign targeting users primarily in the United States since at least June 2025. The operation employs suspected ClickFix-style social engineering, trojanized software installers, and a custom Python-based remote access tool, Starland RAT, to establish persistent access and deploy additional malware, including the previously undocumented WLDR PowerShell framework, CastleStealer, and Remcos RAT. The campaign demonstrates a modular architecture, resilient C2 infrastructure, and a strong emphasis on credential theft, cryptocurrency wallet harvesting, and long-term post-compromise access.

Executive Summary

Threat actors affiliated with Qakbot were observed distributing Ransom Knight ransomware and Remcos RAT.

Related Families: Remcos RAT, Metasploit
Verticals Targeted:  Manufacturing, Retail, Wholesale, Legal, Professional Services

Executive Summary

Mallox, also known as TargetCompany, FARGO, and Tohnichi, is a ransomware family targeting Windows systems, particularly unsecured MS-SQL servers, to compromise victim networks.