Loading malware…
CastleRAT is a modular remote access trojan associated with the TAG-150 malware ecosystem and observed in both Python and C variants. It provides remote control of compromised Windows systems and supports core post-compromise functions including system reconnaissance, command execution through CMD and PowerShell, downloading and executing additional payloads, and data exfiltration. Reported functionality also includes remote shell access, keylogging, and screen capture, with some reporting describing broader operator use for browser-session abuse and account takeover activity. CastleRAT has been linked to a malware-as-a-service ecosystem used by Russian-speaking cybercriminal operators and has also been deployed by the Iranian state-linked group MuddyWater against organizations in Israel, the Middle East, the United States, and Europe. Targeted sectors have included defense, energy, government, and telecommunications. Delivery has commonly occurred as a secondary payload via CastleLoader and in ClickFix-style social-engineering chains, including fake software-update lures and malicious copy-and-paste prompts that trick users into executing attacker-supplied commands. The malware has also been observed using dead-drop resolution, including Steam Community pages, to obtain command-and-control information, contributing to resilience and operational flexibility.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Israeli-Focused Targeting Set Targets include Israeli IP ranges, Laravel web applications, and FortiOS systems. ... MITRE ATT&CK ID Technique ... T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281 | This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
Israeli-Focused Targeting Set Targets include Israeli IP ranges, Laravel web applications, and FortiOS systems. ... MITRE ATT&CK ID Technique ... T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281 | This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
Israeli-Focused Targeting Set Targets include Israeli IP ranges, Laravel web applications, and FortiOS systems. ... MITRE ATT&CK ID Technique ... T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281 | This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
...Velvet Tempest ... used a ClickFix lure ... to drop payloads like DonutLoader and CastleRAT.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Actor attempts logins to financial-institution websites using exfiltrated browser credentials
MITRE ATT&CK ID Technique T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281
These incidents have all included the use of finger.exe as the initial retrieval mechanism with the majority using caret (^) obfuscation on the command string.
`reset.ps1` was found on the MuddyWater-attributed C2 server ... This PowerShell script installs Node.js, AES-decrypts an embedded payload, and deploys the ChainShell pair
Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell.
These incidents have all included the use of finger.exe as the initial retrieval mechanism with the majority using caret (^) obfuscation on the command string.
Analysis of an exposed C2 server revealed 15 malware samples, including CastleRAT builds hidden in steganographic image files and additional JavaScript-based RAT variants.
The Blackpoint APG is currently tracking a campaign that uses ClickFix-style lures fake AMD/Intel software updater prompts to trick users into executing a malicious loader.
CastleRAT is a remote access trojan with several capabilities including keylogging
By adopting CastleRAT and ChainShell, MuddyWater gains access to advanced capabilities including: Hidden Virtual Network Computing (HVNC) for stealth system control Credential theft and Chrome cookie decryption
«CastleRAT» est un cheval de Troie d’accès à distance, conçu pour offrir un contrôle complet d’un système compromis via un serveur C2.
used CastleRAT to proxy the replica’s live browser session, attempting logins against financial-institution websites directly from the compromised workstation
CastleRAT is a RAT that includes C and Python variants sharing the following commonalities: Custom binary protocol using RC4 encryption with hard-coded 16-byte keys
At the time of publication, Phexia is unique from other macOS stealers in its use of dead drop resolution with Telegram, Steam, and blockchain smart contracts to discover command and control (C2) domains for communication.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan available in compiled Python and C builds that supports keylogging, screen capture, remote shell access, dead-drop resolution, and BYOR-style execution.
A remote access trojan used as a secondary payload in an evolving ClickFix-style campaign that uses fake AMD/Intel software update prompts to trick users into executing a malicious loader.
Remote access trojan delivered as a payload by CastleLoader.
Remote access trojan offered via MaaS and used by MuddyWater against defense, energy, government, and telecommunications targets.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.