Loading malware…
CastleLoader is a multi-stage shellcode loader targeting Windows systems and used to deploy information stealers and remote-access malware. It is associated with TAG-150’s malware-as-a-service ecosystem and serves as a delivery component for CastleRAT. Other observed payloads include CastleStealer, NetSupport RAT, SectopRAT, and NeedleStealer components. Its role is payload delivery and execution; credential theft, browser-session theft, and cryptocurrency theft are performed by downstream malware rather than established native loader functions.
CastleLoader campaigns use ClickFix social engineering, fake verification pages, misleading software installers, and fake updates to induce victims to execute malicious commands. Infection chains commonly involve obfuscated PowerShell or batch scripts, legitimate IronPython interpreters, encoded Python stages, and in-memory shellcode execution. Some variants use Node.js-based shellcode injectors or digitally signed malicious installers. The loader retrieves encrypted tasking and additional payloads from attacker-controlled infrastructure, including RC4-encrypted payloads, while limiting on-disk artifacts.
Campaign clusters tracked as Urutyka, Garrigin, and Noidret share loading infrastructure and shellcode components but deploy different payload combinations. Noidret activity introduced NeedleStealer components that impersonate cryptocurrency wallets and install malicious browser extensions, extending the broader campaign ecosystem into recovery-phrase theft and browser-session compromise.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
CastleLoader – TAG-150’s MaaS loader, the entry point to the CastleRAT platform.
Another malware family linked to MuddyWater is a downloader called FakeSet, which the security researchers say was used in recent infections to deliver CastleLoader. CastleLoader is sold as a service to multiple affiliates and cyber crews.
Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model.
Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model.
64 distinct techniques documented for this family, organized by ATT&CK tactic.
"It infiltrates systems via phishing, malvertising, and malicious downloads."
"Attackers abuse trusted platforms like Steam and Discord to boost credibility."
"VS Code forks... recommend extensions that are non-existent... opening the door to supply chain risks"; "Shai-Hulud supply chain outbreak"; "modified Shai-Hulud worm... npm registry"; "Rogue NuGet package..."; "malicious Rust crate..."; "malicious npm package..."
"First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package"; "Self-Replicating Worm Hits 180+ npm Packages"; "SilentSync RAT Delivered via Two Malicious PyPI Packages"; "Malicious Rust Crates Steal Solana and Ethereum Keys"; "VS Code ... republish deleted extensions"
“ClickFix” attacks are based on social engineering techniques and initially appear to be legitimate security checks. During the attack, users are presented with a fake verification page containing messages such as “I am not a robot”
MITRE ATT&CK ID Technique T1566.002 Phishing: ClickFix/BatClickFix social engineering
"Lumma loaders were distributed... via legitimate platforms and content delivery networks... The most significant CDNs observed are: Steam workshop, Discord shared files."
"Some chains observed by the researchers add obfuscated VBA scripts and scheduled tasks for persistence."
The first task is a NetSupport RAT delivery ... write to %ProgramData%\CeoliauD\Dabkina, register as a Scheduled Task with logon trigger so the payload runs on next login
In the Noidret campaign, the wallet spoofer is delivered through a Node.js-based injector and a small shellcode component.
As a result, users unknowingly execute a malicious PowerShell command, enabling malicious loaders to be launched at the next stage on the device.
The downloaded MSI file executes a .bat file that launches a embedded IronPython installation... Obfuscated .bat file invokes an IronPython shellcode injector.
"drop a Visual Basic Script (VBScript) responsible for launching ModeloRAT"; "obfuscated VBA scripts"
“It then retrieves IronPython, which runs compressed and Base64-encoded code that downloads later stages.”
A NodeJS injector script ... decrypts and loads an 8 KB shellcode stub, which then reflectively injects the Rust payload.
“TA0002: Execution T1059.010: AutoHotKey & AutoIT Execution via AutoIt script (freely.a3x)”
pythonw.exe (windowless Python interpreter) -> Runs dynamically generated Python script -> Decrypts data1.pak (AES-CBC, key derived from NSIS script or embedded) -> VirtualAlloc + RtlMoveMemory + function pointer execution
In this case, the bytecode file is another in-memory loader that uses the Windows ctypes interface to execute shellcode received from a local named pipe.
“ClickFix-style social engineering, tricking a user into running a command through the Windows Run dialog”
"...relies on affiliates, social engineering, fake cracked software, and fake CAPTCHA “ClickFix” lures." / "ClickFix pages trick users into pasting malicious PowerShell commands."
“The infection begins with a ClickFix lure that instructs a target to launch a command.”
"Some chains observed by the researchers add obfuscated VBA scripts and scheduled tasks for persistence."
The first task is a NetSupport RAT delivery ... write to %ProgramData%\CeoliauD\Dabkina, register as a Scheduled Task with logon trigger so the payload runs on next login
startup_method Persistence mechanism: 1=Registry Run, 2=Startup LNK, 3=Scheduled Task
startup_method Persistence mechanism: 1=Registry Run, 2=Startup LNK, 3=Scheduled Task
"Some chains observed by the researchers add obfuscated VBA scripts and scheduled tasks for persistence."
The first task is a NetSupport RAT delivery ... write to %ProgramData%\CeoliauD\Dabkina, register as a Scheduled Task with logon trigger so the payload runs on next login
The python script downloads another python script from the C2 server that is responsible for injecting CastleLoader’s stage 2 shellcode... The CastleStealer payload is stored in the .data segment of the loader and gets injected into memory.
The second task is in-memory only ... launch method 7 for APC injection, fetching net40.bin and injecting the resulting .NET binary into a target process without ever touching disk
6 Process hollowing - the launcher calls CreateProcessW with the CREATE_SUSPENDED flag ... copies the malicious PE headers and each section into the target ... sets the suspended thread ... to the payload's entry point
startup_method Persistence mechanism: 1=Registry Run, 2=Startup LNK, 3=Scheduled Task
startup_method Persistence mechanism: 1=Registry Run, 2=Startup LNK, 3=Scheduled Task
run_as_admin The malware will relaunch its parent via cmd.exe /c <parent_process> via ShellExecuteW with the "runas" verb to elevate it as Administrator.
used caret-obfuscated commands ... The shellcode loader used triple-layer encoding (Base64, zlib, UTF-32) and Cyrillic character substitution for obfuscation and fetched an RC4-encrypted payload
“TA0005: Defense Evasion T1027.002: Software Packing Multi-stage: Inno Setup → AutoIt → PE injection”
"Example command line: cmd.exe /c start /min powershell [Text.Encoding]::UTF8.GetString(...hex...) | powershell"
Tasks return encrypted payloads... Each payload from a specific tasking has a unique RC4 key... delivered as a ZIP archive ... alongside ... two AES-GCM encrypted files.
Observations indicate that such campaigns make use of fake interfaces impersonating Google reCAPTCHA and Cloudflare verification pages, as well as deceptive pages associated with Google Meet, QR code services and other well-known platforms.
This directory is also created under %LocalAppData% and mimics a legitimate Python installation structure, depending on the runtime variant being used (embedded CPython or IronPython).
The python script downloads another python script from the C2 server that is responsible for injecting CastleLoader’s stage 2 shellcode... The CastleStealer payload is stored in the .data segment of the loader and gets injected into memory.
The second task is in-memory only ... launch method 7 for APC injection, fetching net40.bin and injecting the resulting .NET binary into a target process without ever touching disk
6 Process hollowing - the launcher calls CreateProcessW with the CREATE_SUSPENDED flag ... copies the malicious PE headers and each section into the target ... sets the suspended thread ... to the payload's entry point
Deletes RunMRU registry key to cover its tracks: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Strips Zone.Identifier ADS (Mark-of-the-Web) to evade SmartScreen
Embedded JavaScript dynamically fetches remote content from this endpoint, applies ROT13 to decode the response... Prior to Base64 decoding, the script replaces specific Cyrillic characters with their Latin equivalents... using Base64 encoding, XOR decryption... The first 64 bytes of the downloaded blob are treated as the RC4 key... all C2 communication is encrypted via the symmetric ChaCha algorithm.
CastleLoader supports 14 launch methods for executing payloads, including ... rundll32.exe ... msiexec.exe
The instance ID is used both as the CreateMutexW name (single-instance gate) and as the filename of the install marker
It uses anti-analysis techniques, including cpuid instructions to detect VMware, VirtualBox, and Parallels virtual environments.
The first thing the binary does is a Russian-locale check. The MUI languages list ... is compared against the literal “ru-RU”, and if any installed UI language matches, execution returns immediately.
The traffic1.exe is a Nullsoft installer that unpacks a Python runtime (ipyw32.exe) and an encoded script (antimony.txt) hidden under the system’s Policies folder.
The start "" /min launches the next stage minimized, so the victim never sees a command window appear.
After substituting and decoding the Base64 blobs, this Python script implements a classic fileless shellcode, using Base64 encoding, XOR decryption, and direct Windows API calls via ctypes to execute payloads entirely in memory.
Arctic Wolf also recommends application allowlisting and preventing unsigned or unexpectedly signed binaries from running in user-writable locations.
We found multiple digitally signed installers pointing to the same infrastructure... The cluster has been observed using fraudulently obtained code-signing certificates... to bypass endpoint controls.
In some cases, malicious components may establish persistence on the system, attempt to weaken the operation of security software
For Chromium-family browsers the stealer reads Login Data ... cookies.sqlite ... Discord is targeted ... Telegram sessions are stolen wholesale by copying the entire tdata directory.
For Chromium-family browsers the stealer reads Login Data (the SQLite password store), cookies.sqlite, and Local State ... CryptUnprotectData specifically to decrypt it.
MITRE ATT&CK maps this behavior primarily to Credential Access (TA0006), specifically T1555 – Credentials from Password Stores and its sub-technique T1555.003 – Credentials from Web Browsers, covering theft of saved browser passwords, cookies, and autofill data.
The loader issues a get_tasks request to its C2 server using generated identifiers of the infected host... along with system profiling data (username, computer_name, domain_name, windows_version, arch, active_av and active_list).
It uses anti-analysis techniques, including cpuid instructions to detect VMware, VirtualBox, and Parallels virtual environments.
The first thing the binary does is a Russian-locale check. The MUI languages list ... is compared against the literal “ru-RU”, and if any installed UI language matches, execution returns immediately.
get_installed_av Enumerate installed AV products via WMI root\SecurityCenter2 using CoCreateInstance and CoSetProxyBlanket
"The batch script does some initial environment checking... tasklist | findstr 'SophosHealth ... AvastUI AVGUI'"
MITRE ATT&CK Mapping ... Discovery System Location Discovery T1614 Checks computer location settings
It can also capture screenshots of the desktop via the GDI BitBlt pipeline.
When the user checks the “I'm not a robot” box, two things happen. First, a payload gets copied to the clipboard via the classic document.execCommand(“copy”).
After decryption, the buffer resolves with a ZIP archive containing the resources of the final payload.
CastleLoader queries its C2 via a get_tasks command. Tasks return encrypted payloads... By replicating the get_tasks request... we were able to decrypt the HTTP response and confirm the payload manifest and downstream C2s...
For the initial configuration fetch, the malware issues a GET request to a hardcoded base URL... the loader contacts only the base endpoint and transmits encrypted data within the HTTP POST request body.
"A failed ping to a fake random domain leaves a detectable DNS trace."
“It abuses Windows finger.exe to retrieve a batch script… [which] retrieves IronPython… code that downloads later stages, including CastleLoader and CastleRAT.”
“…rapidly migrating to new hosting providers and adapting alternative loaders and delivery techniques”.
Apart from the malware's initial GET request, all C2 communication is encrypted via the symmetric ChaCha algorithm.
...a pair of CastleRAT trojan variants enabling system data exfiltration, command execution, and further payload deployment...
Exfiltration: The log is transmitted to the operator, frequently via the Telegram Bot API, which has become the dominant C2 channel because it is cheap, resilient to takedown, and blends into normal traffic.
234 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.