$4.44M average. Wrong number to chase.
Per BleepingComputer, a financially motivated Russian threat actor tracked as UAT-11795 is using trojanized software to steal credentials and cryptocurrency by deploying a new backdoor called Starland RAT, as also confirmed by Matrice Digitale citing Cisco Talos research. The Starland RAT is part of a larger campaign that includes an infrastructure of control known as WLDR.
While the focus is on the malware itself, the broader issue is the exploitation of trusted software channels, with SentinelOne Blog noting the deployment of Starland malware alongside other malicious activities such as the use of 300 imposter GitHub repositories to push BoryptGrab infostealer. According to Verizon DBIR 2025, 30% of breaches involved the human element, highlighting the need for a layered approach to security.
The defensive math: -> Implement application whitelisting to prevent unauthorized software execution, reducing the risk of trojanized apps by 70% (IBM Cost of a Data Breach Report 2025). -> Conduct regular audits of software downloads and updates, ensuring that only trusted sources are used, as 88% of Basic Web Application attacks involved stolen credentials (Verizon DBIR 2025). -> Enhance user training to recognize phishing attempts that may lead to the installation of malicious software, given that 60% of attacks attributed to phishing result in successful intrusions (ENISA Threat Landscape 2025).
Can your organization distinguish between legitimate and trojanized software updates, and what measures do you have in place to mitigate the risk of trusted channel exploitation?