Loading story…
GrayBravo, a technically advanced threat actor previously tracked as TAG-150, has expanded its operations by leveraging the CastleLoader malware in a malware-as-a-service (MaaS) model. Recent analysis identified four distinct activity clusters, each employing unique tactics and targeting different industries, including logistics and hospitality. These clusters utilize sophisticated phishing techniques, such as impersonating global logistics firms and Booking.com, and employ the ClickFix method to distribute CastleLoader alongside other malware like Matanbuchus and CastleRAT. The infrastructure supporting these campaigns is large-scale and multi-layered, demonstrating GrayBravo's adaptability and rapid development cycles.
The CastleLoader framework enables the delivery of various payloads, including infostealers (DeerStealer, RedLine Stealer, StealC Stealer), remote access trojans (NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE), and additional loaders. Security researchers have linked the online persona "Sparja" to GrayBravo's activities, further highlighting the group's presence on underground forums. Defenders are advised to block associated IPs and domains, monitor for unusual connections to legitimate internet services, and deploy updated detection rules. Comprehensive lists of indicators of compromise (IoCs) and mitigation strategies have been provided to help organizations defend against these evolving threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Blackpoint Cyber reported a new evolution of CastleLoader in which victims are socially engineered via ClickFix to run commands that launch an in-memory Python-based loader using pythonw.exe. The updated delivery chain was described as improving stealth by avoiding disk writes and using evasion techniques such as PEB walking and in-memory shellcode execution.
Recorded Future disclosed that GrayBravo's operations can be divided into four distinct activity clusters with different tactics, victim profiles, and delivery methods, including phishing, malvertising, fake software updates, and impersonation of logistics firms and Booking.com. The analysis also highlighted overlapping and redundant infrastructure supporting these campaigns.
Recorded Future and other reporting describe GrayBravo, formerly tracked as TAG-150, as operating CastleLoader and related tools such as CastleRAT and CastleBot through a large, multi-layered malware-as-a-service infrastructure. The reporting does not specify when the operation began, only that it was active by the time of publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcerecordedfuture.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued activity around **CastleLoader/CastleBot** malware delivery chains alongside a resurgence of **KongTuke**, with both threats relying heavily on social-engineering lures and staged payload delivery. Red Canary said CastleLoader remained active since early 2025 and was commonly delivered through paste-and-run fake CAPTCHA or impersonation websites, while Trend Micro documented KongTuke abusing compromised WordPress sites in **ClickFix**-style infection flows. The campaigns reflect a broader shift toward user-assisted execution, where victims are tricked into launching malicious commands that initiate multi-stage malware retrieval. Technical analysis from IBM and Splunk tied the Castle ecosystem to a **malware-as-a-service** operation and detailed the tooling used after execution, including use of `finger.exe` to fetch batch commands, portable Python interpreters as a bring-your-own-interpreter technique, multilayer-obfuscated Python loaders, **RC4**-encrypted payload retrieval, and process injection into `python.exe`. Splunk's review of **Castle RAT** highlighted the client malware's tactics and ATT&CK-mapped behavior, while Red Canary noted anti-analysis checks, C2-based tasking, and detection opportunities such as repeated caret obfuscation in `cmd.exe` command lines. Together, the reporting shows an active loader-and-RAT ecosystem being distributed through fake verification pages and compromised web infrastructure.
Jul 23, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers. The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Jun 29, 2026