Loading story…
Since March 2025, threat actor TAG-150 has launched sophisticated attacks using CastleLoader, CastleBot, and the newly identified CastleRAT, targeting primarily US organizations. The group leverages multi-tiered C2 infrastructure, advanced phishing (including Cloudflare-themed lures), and anti-detection services, achieving high infection rates. CastleRAT, available in Python and C variants, enables system reconnaissance, payload execution, and command execution, with PolySwarm analysts flagging it as an emerging threat.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued activity around **CastleLoader/CastleBot** malware delivery chains alongside a resurgence of **KongTuke**, with both threats relying heavily on social-engineering lures and staged payload delivery. Red Canary said CastleLoader remained active since early 2025 and was commonly delivered through paste-and-run fake CAPTCHA or impersonation websites, while Trend Micro documented KongTuke abusing compromised WordPress sites in **ClickFix**-style infection flows. The campaigns reflect a broader shift toward user-assisted execution, where victims are tricked into launching malicious commands that initiate multi-stage malware retrieval. Technical analysis from IBM and Splunk tied the Castle ecosystem to a **malware-as-a-service** operation and detailed the tooling used after execution, including use of `finger.exe` to fetch batch commands, portable Python interpreters as a bring-your-own-interpreter technique, multilayer-obfuscated Python loaders, **RC4**-encrypted payload retrieval, and process injection into `python.exe`. Splunk's review of **Castle RAT** highlighted the client malware's tactics and ATT&CK-mapped behavior, while Red Canary noted anti-analysis checks, C2-based tasking, and detection opportunities such as repeated caret obfuscation in `cmd.exe` command lines. Together, the reporting shows an active loader-and-RAT ecosystem being distributed through fake verification pages and compromised web infrastructure.
Jul 23, 2026
GrayBravo, a technically advanced threat actor previously tracked as TAG-150, has expanded its operations by leveraging the CastleLoader malware in a malware-as-a-service (MaaS) model. Recent analysis identified four distinct activity clusters, each employing unique tactics and targeting different industries, including logistics and hospitality. These clusters utilize sophisticated phishing techniques, such as impersonating global logistics firms and Booking.com, and employ the ClickFix method to distribute CastleLoader alongside other malware like Matanbuchus and CastleRAT. The infrastructure supporting these campaigns is large-scale and multi-layered, demonstrating GrayBravo's adaptability and rapid development cycles. The CastleLoader framework enables the delivery of various payloads, including infostealers (DeerStealer, RedLine Stealer, StealC Stealer), remote access trojans (NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE), and additional loaders. Security researchers have linked the online persona "Sparja" to GrayBravo's activities, further highlighting the group's presence on underground forums. Defenders are advised to block associated IPs and domains, monitor for unusual connections to legitimate internet services, and deploy updated detection rules. Comprehensive lists of indicators of compromise (IoCs) and mitigation strategies have been provided to help organizations defend against these evolving threats.
Jun 29, 2026Researchers reported multiple campaigns tied to the **CastleLoader/CastleRAT** malware ecosystem, showing operators adopting uncommon runtimes and social-engineering lures to bypass enterprise controls. ThreatDown said attackers used the **Deno JavaScript runtime** in what it described as the first observed abuse of Deno for malware delivery and evasion, while LevelBlue documented a related **ClickFix** variant that impersonated **LinkedIn** and **Indeed** through typosquatted domains and fake CAPTCHA pages to trick victims into launching malicious commands. In the ClickFix intrusion chain, attackers abused native Windows tools including `finger.exe`, `curl.exe`, `tar.exe`, and `cmd.exe` together with portable Python runtimes to stage fileless payloads in memory. The activity culminated in deployment of **CastleLoader**, a malware-as-a-service framework using **RC4**- and **ChaCha20**-protected communications to fetch tasks and follow-on payloads, including a Python-based RAT that profiles victims, weakens TLS validation, communicates over WebSockets, enables interactive shell access, uploads and executes payloads, and maintains persistence with mutex and watchdog mechanisms.
Jun 29, 2026