Loading story…
Arctic Wolf Labs reported that threat activity built around CastleLoader, a multi-stage shellcode loader, has expanded into multiple related malware campaigns. The company said CastleLoader has supported several intrusion sets over the past year and is now being observed alongside additional tooling, including the .NET-based CastleStealer and PythonRAT, indicating a broader and evolving malware ecosystem rather than a single isolated payload.
The report also highlights a newly identified connection to NeedleStealer, extending earlier public reporting on related components by Huntress and LevelBlue. The findings suggest operators are reusing and adapting established malware families and delivery chains, giving defenders new indicators for tracking campaigns tied to CastleLoader and its associated stealers and remote-access tooling.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Arctic Wolf Labs reported on a cluster of malware campaigns centered on the multi-stage CastleLoader shellcode loader and connected the activity to previously documented tooling including CastleStealer and PythonRAT, while highlighting a newly noted NeedleStealer connection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
arcticwolf.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourcemalware.news
Open sourcearcticwolf.com
Open sourcebeelzebub.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued activity around **CastleLoader/CastleBot** malware delivery chains alongside a resurgence of **KongTuke**, with both threats relying heavily on social-engineering lures and staged payload delivery. Red Canary said CastleLoader remained active since early 2025 and was commonly delivered through paste-and-run fake CAPTCHA or impersonation websites, while Trend Micro documented KongTuke abusing compromised WordPress sites in **ClickFix**-style infection flows. The campaigns reflect a broader shift toward user-assisted execution, where victims are tricked into launching malicious commands that initiate multi-stage malware retrieval. Technical analysis from IBM and Splunk tied the Castle ecosystem to a **malware-as-a-service** operation and detailed the tooling used after execution, including use of `finger.exe` to fetch batch commands, portable Python interpreters as a bring-your-own-interpreter technique, multilayer-obfuscated Python loaders, **RC4**-encrypted payload retrieval, and process injection into `python.exe`. Splunk's review of **Castle RAT** highlighted the client malware's tactics and ATT&CK-mapped behavior, while Red Canary noted anti-analysis checks, C2-based tasking, and detection opportunities such as repeated caret obfuscation in `cmd.exe` command lines. Together, the reporting shows an active loader-and-RAT ecosystem being distributed through fake verification pages and compromised web infrastructure.
Jul 23, 2026Researchers reported multiple campaigns tied to the **CastleLoader/CastleRAT** malware ecosystem, showing operators adopting uncommon runtimes and social-engineering lures to bypass enterprise controls. ThreatDown said attackers used the **Deno JavaScript runtime** in what it described as the first observed abuse of Deno for malware delivery and evasion, while LevelBlue documented a related **ClickFix** variant that impersonated **LinkedIn** and **Indeed** through typosquatted domains and fake CAPTCHA pages to trick victims into launching malicious commands. In the ClickFix intrusion chain, attackers abused native Windows tools including `finger.exe`, `curl.exe`, `tar.exe`, and `cmd.exe` together with portable Python runtimes to stage fileless payloads in memory. The activity culminated in deployment of **CastleLoader**, a malware-as-a-service framework using **RC4**- and **ChaCha20**-protected communications to fetch tasks and follow-on payloads, including a Python-based RAT that profiles victims, weakens TLS validation, communicates over WebSockets, enables interactive shell access, uploads and executes payloads, and maintains persistence with mutex and watchdog mechanisms.
Jun 29, 2026
Elastic Security Labs identified **OXLOADER**, a previously undocumented Windows loader used in a malvertising campaign to deploy the **CASTLESTEALER** information stealer. Malicious Google Ads impersonating Node.js redirected primarily U.S.-based targets through a redirector to Storj-hosted batch scripts, which downloaded OXLOADER and attempted to elevate its privileges. Geographic exclusions for Commonwealth of Independent States countries and Russian-language systems indicate a likely financially motivated, Russian-speaking operator. OXLOADER uses layered obfuscation, self-modifying decryption stubs, anti-sandbox checks, and runtime API resolution to evade detection. It stages shellcode in a PE file's `.reloc` section, adds an RWX `.xtext` section to a copied Windows DLL for execution, and uses DonutLoader to execute CASTLESTEALER as an in-memory .NET payload. The operation illustrates MITRE ATT&CK **Resource Development** activity, including malvertising, acquired hosting, and staged malware capabilities; Elastic reported low static and sandbox detection rates and released YARA rules and indicators for detection.
Sep 9, 2026