Loading story…
GrayBravo, a technically advanced threat actor previously tracked as TAG-150, has expanded its operations by leveraging the CastleLoader malware in a malware-as-a-service (MaaS) model. Recent analysis identified four distinct activity clusters, each employing unique tactics and targeting different industries, including logistics and hospitality. These clusters utilize sophisticated phishing techniques, such as impersonating global logistics firms and Booking.com, and employ the ClickFix method to distribute CastleLoader alongside other malware like Matanbuchus and CastleRAT. The infrastructure supporting these campaigns is large-scale and multi-layered, demonstrating GrayBravo's adaptability and rapid development cycles.
The CastleLoader framework enables the delivery of various payloads, including infostealers (DeerStealer, RedLine Stealer, StealC Stealer), remote access trojans (NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE), and additional loaders. Security researchers have linked the online persona "Sparja" to GrayBravo's activities, further highlighting the group's presence on underground forums. Defenders are advised to block associated IPs and domains, monitor for unusual connections to legitimate internet services, and deploy updated detection rules. Comprehensive lists of indicators of compromise (IoCs) and mitigation strategies have been provided to help organizations defend against these evolving threats.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Blackpoint Cyber reported a new evolution of CastleLoader in which victims are socially engineered via ClickFix to run commands that launch an in-memory Python-based loader using pythonw.exe. The updated delivery chain was described as improving stealth by avoiding disk writes and using evasion techniques such as PEB walking and in-memory shellcode execution.
Recorded Future disclosed that GrayBravo's operations can be divided into four distinct activity clusters with different tactics, victim profiles, and delivery methods, including phishing, malvertising, fake software updates, and impersonation of logistics firms and Booking.com. The analysis also highlighted overlapping and redundant infrastructure supporting these campaigns.
Recorded Future and other reporting describe GrayBravo, formerly tracked as TAG-150, as operating CastleLoader and related tools such as CastleRAT and CastleBot through a large, multi-layered malware-as-a-service infrastructure. The reporting does not specify when the operation began, only that it was active by the time of publication.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcerecordedfuture.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued activity around **CastleLoader/CastleBot** malware delivery chains alongside a resurgence of **KongTuke**, with both threats relying heavily on social-engineering lures and staged payload delivery. Red Canary said CastleLoader remained active since early 2025 and was commonly delivered through paste-and-run fake CAPTCHA or impersonation websites, while Trend Micro documented KongTuke abusing compromised WordPress sites in **ClickFix**-style infection flows. The campaigns reflect a broader shift toward user-assisted execution, where victims are tricked into launching malicious commands that initiate multi-stage malware retrieval. Technical analysis from IBM and Splunk tied the Castle ecosystem to a **malware-as-a-service** operation and detailed the tooling used after execution, including use of `finger.exe` to fetch batch commands, portable Python interpreters as a bring-your-own-interpreter technique, multilayer-obfuscated Python loaders, **RC4**-encrypted payload retrieval, and process injection into `python.exe`. Splunk's review of **Castle RAT** highlighted the client malware's tactics and ATT&CK-mapped behavior, while Red Canary noted anti-analysis checks, C2-based tasking, and detection opportunities such as repeated caret obfuscation in `cmd.exe` command lines. Together, the reporting shows an active loader-and-RAT ecosystem being distributed through fake verification pages and compromised web infrastructure.
Jul 23, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026
Arctic Wolf Labs reported that threat activity built around **CastleLoader**, a multi-stage shellcode loader, has expanded into multiple related malware campaigns. The company said CastleLoader has supported several intrusion sets over the past year and is now being observed alongside additional tooling, including the **.NET-based CastleStealer** and **PythonRAT**, indicating a broader and evolving malware ecosystem rather than a single isolated payload. The report also highlights a newly identified connection to **NeedleStealer**, extending earlier public reporting on related components by Huntress and LevelBlue. The findings suggest operators are reusing and adapting established malware families and delivery chains, giving defenders new indicators for tracking campaigns tied to CastleLoader and its associated stealers and remote-access tooling.
Jul 28, 2026