CastleLoader Threat Clusters: What Enterprises Must Know Now

In recent months, the cyber-threat landscape shifted dramatically as CastleLoader threat clusters expanded and intensified, driving GrayBravo’s malware-as-a-service (MaaS) operation into a more aggressive phase. Security researchers tracked four active clusters, each using distinct lures and delivery strategies to push CastleLoader into corporate and individual environments. These clusters deploy remote access trojans (RATs), infostealers, and secondary loaders, creating a surge in high-impact intrusions. This shift shows how CastleLoader moved from a niche loader into a central weapon within a rapidly evolving malware ecosystem.

Modular Malware Delivery with CastleLoader

CastleLoader operates as a modular loader, enabling attackers to retrieve and install additional payloads after gaining an initial foothold. This multi-stage approach lets operators separate the first infection step from the final malicious action, which directly complicates defensive analysis and attribution.

Within GrayBravo’s infrastructure, CastleLoader integrates with components such as CastleRAT and CastleBot, forming a flexible chain of execution. A stager or downloader initiates CastleLoader, and the loader then pulls the attacker’s chosen backdoor or stealer modules.

Across multiple campaigns, operators armed CastleLoader with diverse payloads, including RedLine, DeerStealer, NetSupport RAT, SectopRAT, and additional loaders like Hijack Loader.

This modular flexibility — allowing threat actors to swap payloads on demand based on target value or operational goals — explains CastleLoader’s rapid adoption within cyber-criminal circles.

Four Active Clusters, Four Distinct Attack Patterns

Researchers at the firm tracking GrayBravo uncovered four separate clusters, each with its own tactics, victim profiles, and delivery methods. Each cluster uses CastleLoader as the core loader but differs significantly in social-engineering and distribution strategy.

Logistics Sector Phishing & ClickFix (TAG-160):

This cluster targets logistics companies and freight carriers. Using phishing emails impersonating legitimate logistics firms and freight-matching platforms, attackers entice recipients with fake shipping quotes or rate confirmations. Some lure victims to copy and paste malicious links (“ClickFix” technique), while others spoof compromised or typosquatted domains to appear legitimate.

Because the emails mimic real industry communications — including quote PDFs and what appears to be genuine freight-matching platform activity — this cluster effectively bypasses many basic email-filtering defenses. Once the victim clicks, CastleLoader is delivered, paving the way for payload deployment.

Booking-themed ClickFix Phishing (TAG-161):

This cluster uses lures themed after widely trusted travel and booking services. Attackers send phishing emails or distribute links pretending to be from a travel-booking platform. Victims are urged to click a link to confirm or view booking details. Upon interaction, CastleLoader or related payloads (such as Matanbuchus) are deployed.

Notably, this cluster uses custom phishing-email management tools, suggesting attackers behind TAG-161 maintain dedicated infrastructure to automate and scale their campaigns.

Booking-themed with Dead-Drop Resolver & RAT Deployment:

Similar to Cluster 2 in its travel-themed deception, this cluster adds sophistication by using dead-drop resolvers (e.g., legitimate community pages) to hide C2 communications. In some cases, CastleRAT has been deployed instead of just a loader — giving attackers full remote control over compromised systems.

This variation demonstrates how GrayBravo’s infrastructure supports multiple payloads and different objectives depending on the cluster actor’s goals — from credential theft to long-term access and espionage.

Malvertising & Fake Update Lures (Zabbix / RVTools):

This cluster diverges from phishing email campaigns and instead uses malvertising and fake software-update prompts masquerading as legitimate IT tools (like network monitoring software). When users attempt to “update” or download these tools, CastleLoader is delivered. Once inside, it can load malicious modules such as NetSupport RAT or info-stealers.

Because such updates appear as standard routine maintenance often expected in corporate environments this tactic can evade perimeter defenses and trick end-users into installing malware themselves.

Why This Matters for Enterprises and Defenders

The emergence of these four clusters shows that CastleLoader is no longer a niche threat it has matured into a robust MaaS infrastructure capable of serving a variety of malicious actors with differing goals: data theft, backdoor access, espionage, or even further malware distribution.

Key risks and implications include:

• High likelihood of supply-chain and enterprise compromise: Because clusters target sectors like logistics and corporate travel — industries that rely heavily on third-party communications and remote access — organizations across global supply chains are at risk.

• Malware polymorphism and payload flexibility: Attackers can change payloads quickly (stealer, RAT, loader, or hybrid), depending on the target and objective making detection harder and reducing the value of static signatures.

• Attribution difficulty: With a modular loader and multiple clusters, linking attacks to a single actor becomes challenging. The use of dead-drop resolvers and anonymized infrastructure further complicates forensics.

• Scaling via MaaS model: GrayBravo’s infrastructure appears to support multiple affiliates or clients, meaning infection volume could surge rapidly as more threat operators adopt CastleLoader for their campaigns.

Defensive Strategies & Mitigations

To mitigate risks posed by CastleLoader threat clusters, security teams should take the following steps:

Implement and Enforce Email & Phishing Defenses

Deploy strict email filtering rules, block attachments and links from suspicious domains, and enforce sender-verification protocols. Pay special attention to emails mimicking freight-matching platforms, logistics firms, or booking services, especially those requesting action such as “click this link” or “confirm your booking.”

Harden Endpoint Security & Monitoring

Deploy behavior-based detection (YARA, Sigma, or Snort signatures) to identify shellcode stagers, suspicious DLL loads, or unauthorized process injections. Monitor for connections to known malicious C2 servers, consider restricting outbound traffic to unapproved domains, and disable execution of unsigned installers or scripts.

User Awareness & Least-Privilege Policies

Train users especially in logistics, supply chain, and corporate travel departments to recognize phishing and fake-update lures. Enforce the principle of least privilege so even if a user executes CastleLoader, the damage remains limited.

Network Segmentation & Monitoring

Segment corporate networks so that even if one machine is compromised, the attack cannot easily pivot laterally. Monitor for unusual outbound traffic, and isolate systems exhibiting suspect behavior.

FAQs

Q: What is “CastleLoader”?
A: CastleLoader is a modular malware loader, a type of malicious software designed to download and execute additional payloads (such as RATs, stealers, or loaders) on a compromised system. Its modular design helps threat actors evade detection and adapt payloads based on target value.

Q: Who is behind these CastleLoader threat clusters?
A: The clusters are linked to a threat-actor group known as GrayBravo (formerly tracked as TAG-150). GrayBravo operates these campaigns via a MaaS model, lending its loader infrastructure to multiple affiliates or malicious clients.

Q: What kinds of payloads does CastleLoader deliver?
A: Known payloads include remote access trojans (RATs) like CastleRAT and NetSupport RAT, infostealers such as RedLine, DeerStealer, StealC, and potentially secondary loaders or additional malware families depending on the operator’s choice.

Q: How do attackers distribute CastleLoader?
A: Attackers use multiple vectors, phishing emails impersonating logistics firms or travel services, fake software-update prompts via malvertising, fake GitHub repositories, and deceptive “ClickFix” links and landing pages to trick users into executing the loader.

Q: What should defenders do now?
A: Implement strong email filtering, enforce least-privilege policies, deploy behavioral/memory-analysis detection rules, monitor network traffic for C2 activity, isolate endpoints, apply segmentation, and integrate threat intelligence feeds with IoCs to stay ahead of emerging CastleLoader variants.