TAG-150 Develops CastleRAT in Python and C, Increasing CastleLoader Malware Operations

The risk actor behind the malware-as-a-service (MaaS) framework and loader referred to as CastleLoader has additionally developed a distant entry trojan often known as CastleRAT.

“Obtainable in each Python and C variants, CastleRAT’s core performance consists of accumulating system info, downloading and executing extra payloads, and executing instructions through CMD and PowerShell,” Recorded Future Insikt Group stated.

The cybersecurity firm is monitoring the risk actor behind the malware households as TAG-150. Believed to be lively since a minimum of March 2025, CastleLoader et al are seen as preliminary entry vectors for a variety of secondary payloads, together with distant entry trojans, info stealers, and even different loaders.

CastleLoader (aka CastleBot) was first documented by Swiss cybersecurity firm PRODAFT in July 2025, as having been put to make use of in numerous campaigns distributing DeerStealer, RedLine, StealC, NetSupport RAT, SectopRAT, and Hijack Loader.

A subsequent evaluation from IBM X-Power final month discovered that the malware has additionally served as a conduit for MonsterV2 and WARMCOOKIE by means of website positioning poisoning and GitHub repositories impersonating professional software program.

“Infections are mostly initiated by means of Cloudflare-themed ‘ClickFix’ phishing assaults or fraudulent GitHub repositories masquerading as professional purposes,” Recorded Future stated.

“The operators make use of the ClickFix method by leveraging domains that imitate software program improvement libraries, on-line assembly platforms, browser replace alerts, and doc verification programs.”

Proof signifies that TAG-150 has been engaged on CastleRAT since March 2025, with the risk actor leveraging a multi-tiered infrastructure comprising Tier 1 victim-facing command-and-control (C2) servers, in addition to Tier 2 and Tier 3 servers which are principally digital personal servers (VPSes), and Tier 4 backup servers.

CastleRAT, the newly found addition to TAG-150’s arsenal, can obtain next-stage payloads, allow distant shell capabilities, and even delete itself. It additionally makes use of Steam Group profiles as lifeless drop resolvers to level to the precise C2 servers (“programsbookss[.]com”).

Notably, CastleRAT is available in two variations, one written in C and the opposite, programmed in Python, with the latter additionally referred to as PyNightshade. It is price noting that eSentire is monitoring the identical malware beneath the title NightshadeC2.

The C variant of CastleRAT incorporates extra performance, permitting it to log keystrokes, seize screenshots, add/obtain information, and performance as a cryptocurrency clipper to substitute pockets addresses copied to the clipboard with an attacker-controlled one with the purpose of redirecting transactions.

“As with the Python variant, the C variant queries the extensively abused IP geolocation service ip-api[.]com to gather info based mostly on the contaminated host’s public IP handle,” Recorded Future stated. “Nevertheless, the scope of knowledge has been expanded to incorporate the town, ZIP code, and indicators of whether or not the IP is related to a VPN, proxy, or TOR node.”

That stated, latest iterations of the C variant of CastleRAT have eliminated querying of the town and ZIP code from ip-api[.]com, indicating lively improvement. It stays to be seen if its Python counterpart will attain function parity.

eSentire, in its personal evaluation of NightshadeC2, described it as a botnet that is deployed by the use of a .NET loader, which, in flip, makes use of methods like UAC Immediate Bombing to sidestep safety protections. The Canadian cybersecurity firm stated it additionally recognized variants geared up with options to extract passwords and cookies from Chromium- and Gecko-based internet browsers.

In a nutshell, the method entails working a PowerShell command in a loop that makes an attempt so as to add an exclusion in Home windows Defender for the ultimate payload (i.e., NightshadeC2), after which the loader verifies the exit code of the PowerShell course of to determine if it is 0 (which means success).

If the exclusion is efficiently added, the loader proceeds to ship the malware. If another exit code aside from 0 is returned, the loop retains executing repeatedly, forcing the person to approve the Person Account Management (UAC) immediate.

“A very notable facet of this strategy is that programs with the WinDefend (Home windows Defender) service disabled will generate non-zero exit codes, inflicting malware evaluation sandboxes to grow to be trapped within the execution loop,” eSentire stated, including the tactic allows a bypass of a number of sandbox options.

Given the absence of any darkish internet ads associated to TAG-150, it is at the moment not clear how the companies are distributed to different actors. However it’s potential that they’re being promoted inside a trusted circle of associates. For sure, the emergence of CastleRAT is an indication that the operators could also be seeking to construct an end-to-end toolset, permitting them to not solely cost extra for a subscription, but in addition fine-tune their operations at a quicker tempo.

The event comes as Hunt.io detailed one other malware loader codenamed TinyLoader that has been used to serve Redline Stealer and DCRat.

Moreover establishing persistence by modifying Home windows Registry settings, the malware screens the clipboard and immediately replaces copied crypto pockets addresses. Its C2 panels are hosted throughout Latvia, the U.Okay., and the Netherlands.

“TinyLoader installs each Redline Stealer and cryptocurrency stealers to reap credentials and hijack transactions,” the corporate stated. “It spreads by means of USB drives, community shares, and pretend shortcuts that trick customers into opening it.”

The findings additionally coincide with the invention of two new malware households, a Home windows-based keylogger referred to as TinkyWinkey and a Python info stealer known as Inf0s3c Stealer, that may accumulate keyboard enter and collect in depth system info, respectively.

Additional evaluation of Inf0s3c Stealer has recognized factors of similarity with Clean Grabber and Umbral-Stealer, two different publicly obtainable malware households, suggesting that the identical writer may very well be liable for all three strains.

“TinkyWinkey represents a extremely succesful and stealthy Home windows-based keylogger that mixes persistent service execution, low-level keyboard hooks, and complete system profiling to collect delicate info,” CYFIRMA stated.

Inf0s3c Stealer “systematically collects system particulars, together with host identifiers, CPU info, and community configuration, and captures screenshots. It enumerates working processes and generates hierarchical views of person directories, comparable to Desktop, Paperwork, Footage, and Downloads.”