← threat actors
how they got in
- software update 1 · Jul 17
sectors
- finance 1 · Jul 17
- technology 1 · Jul 17
geography
- europe 1 · Jul 17
- united states 1 · Jul 17
malware and tools
- starland rat 1 · Jul 17
- wldr 1 · Jul 17
attack phases seen
- Command and control 1 · Jul 17
- Credential access 1 · Jul 17
- Execution 1 · Jul 17
- Exfiltration 1 · Jul 17
- Initial access 1 · Jul 17
what we reported, newest first, grouped by story
July 17, 2026
- UAT-11795, a Russian-speaking financially motivated actor, is trojanizing WebEx and Zoom installers to deploy the new in-memory Python Starland RAT and a bespoke PowerShell C2 implant (WLDR), targeting US and European victims for credential and crypto theft (Cisco Talos, BleepingComputer).
· Jul 17 · observed · via software update · Threat Activity