Loading malware…
CastleRAT is a remote access trojan associated with the TAG-150, later GrayBravo, criminal ecosystem and used in both cybercrime and espionage operations. It has been observed in Python and C variants and is operated as part of a broader malware-as-a-service platform alongside CastleLoader and related tooling. The malware is designed to provide full remote control of compromised Windows systems, with core functions including host reconnaissance, command execution through CMD and PowerShell, download and execution of additional payloads, and encrypted command-and-control communications. Reported functionality across observed variants also includes keylogging, screenshot capture, clipboard monitoring, scheduled-task persistence, and data exfiltration. Additional capabilities attributed to the broader CastleRAT ecosystem include browser credential theft, abuse of live browser sessions, Hidden VNC, SOCKS5 proxying, and use of legitimate web services or dead-drop resolvers to conceal or dynamically resolve command-and-control infrastructure, including Steam Community pages in some campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Israeli-Focused Targeting Set Targets include Israeli IP ranges, Laravel web applications, and FortiOS systems. ... MITRE ATT&CK ID Technique ... T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281 | This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
Israeli-Focused Targeting Set Targets include Israeli IP ranges, Laravel web applications, and FortiOS systems. ... MITRE ATT&CK ID Technique ... T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281 | This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
Israeli-Focused Targeting Set Targets include Israeli IP ranges, Laravel web applications, and FortiOS systems. ... MITRE ATT&CK ID Technique ... T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281 | This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
This report documents a direct operational link between the exposed infrastructure of Iranian threat actor MuddyWater and TAG-150 CastleRAT malware – a modular malware-as-a-service (MaaS) platform developed by Russian-speaking cybercriminals.
...Velvet Tempest ... used a ClickFix lure ... to drop payloads like DonutLoader and CastleRAT.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
Actor attempts logins to financial-institution websites using exfiltrated browser credentials
MITRE ATT&CK ID Technique T1190 CVE-2024-55591, CVE-2024-23113, CVE-2026-1281
These incidents have all included the use of finger.exe as the initial retrieval mechanism with the majority using caret (^) obfuscation on the command string.
`reset.ps1` was found on the MuddyWater-attributed C2 server ... This PowerShell script installs Node.js, AES-decrypts an embedded payload, and deploys the ChainShell pair
These incidents have all included the use of finger.exe as the initial retrieval mechanism with the majority using caret (^) obfuscation on the command string.
Analysis of an exposed C2 server revealed 15 malware samples, including CastleRAT builds hidden in steganographic image files and additional JavaScript-based RAT variants.
The following features have been implemented and unchanged since the CastleRAT Python variant was first observed in late July 2025: ... Self-delete
«CastleRAT» se distingue par ses capacités d’espionnage avancées (keylogging, capture d’écran, accès aux périphériques audio/vidéo)
By adopting CastleRAT and ChainShell, MuddyWater gains access to advanced capabilities including: Hidden Virtual Network Computing (HVNC) for stealth system control Credential theft and Chrome cookie decryption
«CastleRAT» se distingue par ses capacités d’espionnage avancées (keylogging, capture d’écran, accès aux périphériques audio/vidéo)
«CastleRAT» est un cheval de Troie d’accès à distance, conçu pour offrir un contrôle complet d’un système compromis via un serveur C2.
used CastleRAT to proxy the replica’s live browser session, attempting logins against financial-institution websites directly from the compromised workstation
CastleRAT is a RAT that includes C and Python variants sharing the following commonalities: Custom binary protocol using RC4 encryption with hard-coded 16-byte keys
For example, C2 deaddrops hosted on Steam Community pages is a new development, first observed in late August 2025.
tout en permettant à l’attaquant d’exécuter des commandes à distance, de télécharger d’autres charges malveillantes
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan delivered as a payload by CastleLoader.
Remote access trojan offered via MaaS and used by MuddyWater against defense, energy, government, and telecommunications targets.
Remote access trojan delivered in the evolving ClickFix-style campaign previously associated with CastleLoader.
A Russian-developed malware-as-a-service remote access trojan ecosystem adopted by MuddyWater, providing capabilities such as HVNC, credential theft, and Chrome cookie decryption.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.