CastleLoader Activity Clusters Target Multiple Industries
GrayBravo operates a malware-as-a-service model distributing CastleLoader malware through multiple distinct activity clusters targeting various industries. These clusters use phishing campaigns impersonating logistics firms and Booking. com, leveraging the ClickFix technique to deliver malware. The threat actor demonstrates rapid evolution and technical sophistication, adapting quickly to public exposure. While no known exploits in the wild are reported, the malware's distribution methods and impersonation tactics pose significant risks to confidentiality and operational integrity. European organizations in logistics, travel, and e-commerce sectors are particularly at risk due to targeted impersonations. Mitigation requires tailored phishing defenses, enhanced email filtering, user training focused on specific lures, and monitoring for CastleLoader indicators. Countries with significant logistics and travel industries, such as Germany, the UK, France, and the Netherlands, are most likely affected. The threat is assessed as medium severity given its phishing-based delivery, lack of known exploits, and targeted scope.
AI Analysis
Technical Summary
The GrayBravo threat actor group operates a malware-as-a-service (MaaS) model centered around CastleLoader, a sophisticated malware family. Insikt Group has identified four distinct activity clusters linked to GrayBravo, each with unique tactics and victim profiles, indicating a modular and adaptable operation. Two notable clusters, TAG-160 and TAG-161, impersonate logistics companies and Booking.com respectively, using phishing campaigns that employ the ClickFix technique to distribute CastleLoader. ClickFix involves embedding malicious payloads or links within seemingly legitimate communications to bypass traditional security filters. The malware itself is part of a broader ecosystem including CastleRAT, CastleBot, and other tools, suggesting a comprehensive toolkit supporting various attack stages. GrayBravo’s rapid evolution and adaptability allow it to modify tactics in response to public exposure, increasing its resilience. Although no known exploits are currently reported in the wild, the phishing-based infection vector and impersonation of trusted brands increase the likelihood of successful compromise. The threat actor’s ties to the online persona “Sparja” and the wider cybercriminal ecosystem highlight potential collaboration and resource sharing, enhancing operational capabilities. The report underscores the importance of targeted defenses against these phishing lures and the need for continuous monitoring of CastleLoader-related activity.
Potential Impact
European organizations, especially those in logistics, travel, and e-commerce sectors, face significant risks from GrayBravo’s CastleLoader campaigns. Successful phishing attacks can lead to malware installation, resulting in data exfiltration, credential theft, and potential lateral movement within networks. This compromises confidentiality and integrity of sensitive business and customer data. Operational disruptions may occur if malware affects critical systems, impacting availability. The impersonation of well-known brands like Booking.com increases the likelihood of user interaction, raising the risk of initial compromise. Given the MaaS model, multiple organizations across industries could be targeted simultaneously, amplifying the threat’s scale. The adaptability of GrayBravo means defenses must continuously evolve to counter new tactics. For European entities, breaches could also have regulatory repercussions under GDPR due to potential data leaks. The medium severity reflects the balance between the threat’s sophistication and the reliance on phishing vectors, which can be mitigated with proper controls.
Mitigation Recommendations
1. Implement advanced email filtering solutions capable of detecting and blocking phishing emails that use brand impersonation and ClickFix techniques. 2. Conduct targeted user awareness training focusing on recognizing phishing lures related to logistics firms and Booking.com, emphasizing the risks of interacting with unexpected links or attachments. 3. Deploy endpoint detection and response (EDR) tools to identify and contain CastleLoader malware activity promptly. 4. Monitor network traffic for indicators of compromise associated with CastleLoader and related tools like CastleRAT and CastleBot. 5. Enforce multi-factor authentication (MFA) across all user accounts to reduce the impact of credential theft. 6. Maintain up-to-date threat intelligence feeds to stay informed about evolving GrayBravo tactics and indicators. 7. Establish incident response plans specifically addressing phishing and malware infections linked to MaaS operations. 8. Collaborate with industry peers and information sharing organizations to exchange intelligence on emerging threats and mitigation strategies. 9. Regularly audit and restrict permissions to limit malware lateral movement within networks. 10. Verify the authenticity of communications purporting to be from logistics or travel companies through out-of-band channels before acting on requests.
Affected Countries
Germany, United Kingdom, France, Netherlands, Italy, Spain
Indicators of Compromise
- ip: 185.149.146.118
- ip: 185.196.9.222
- ip: 185.196.10.8
- ip: 185.196.9.80
- ip: 192.153.57.125
- ip: 45.155.249.121
- ip: 77.83.207.55
- hash: 35f81d066028f5e69508956bed79d3ee
- hash: 4b139d1e079eb10ffd2543e22ea438dd
- hash: a0e6555acf7d7a273b76067f89884705
- hash: c581969dc1561794c9b0adedbf2ac492
- hash: f8fae59f47f269cb4ee50e701fddc76c
- hash: 47edb5743df7747fccdcd64421dd64a92f24d1fc
- hash: 634c051e17eec0345f0db57f364741603bd1929f
- hash: 861fa0a2edec4b773852029abea4b03ba17f181d
- hash: ae1a8e192b8416b72da711dbd8b32eaf80d788e3
- hash: f278f8326aa5d63161d6648b41e1b3b8ba077061
- hash: 058d83fd8834246d6d2a2771e6e0aeb4d4ef8a6984cbe1133f3a569029a4b1f7
- hash: 190e673787bfc6e8eeebccd64c8da61747d5be06f87d3aea879118ef1a9f4836
- hash: 1b6befc65b19a63b4131ce5bcc6e8c0552fe1e1d136ab94bc7d81b3924056156
- hash: 1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75
- hash: 202f6b6631ade2c41e4762e5877ce0063a3beabce0c3f8564b6499a1164c1e04
- hash: 25e0008aba82690e0f58c9d9fcfbc5d49820aa78d2f7bfcd0b85fb969180fc04
- hash: 53775af67e9df206ed3f9c0a3756dbbc4968a77b1df164e9baddb51e61ac82df
- hash: 60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0
- hash: 6444f0e3f78254aef663837562d258a2236a77f810ee8d832de7d83e0fdd5783
- hash: 67cf6d5332078ff021865d5fef6dc61e90b89bc411d8344754247ccd194ff65b
- hash: 94dc0f696a46f3c225b0aa741fbd3b8997a92126d66d7bc7c9dd8097af0de52a
- hash: 963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d
- hash: b45cce4ede6ffb7b6f28f75a0cbb60e65592840d98dcb63155b9fa0324a88be2
- hash: cf202498b85e6f0ae4dffae1a65acbfec78cc39fce71f831d45f916c7dedfa0c
- hash: d87ccd5a2911e46a1efbc0ef0cfe095f136de98df055eacd1c82de76ae6fecec
- hash: e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928
- hash: fb9de7448e9e30f717c171f1d1c90ac72828803a16ad385757aeecc853479d3c
- ip: 104.225.129.171
- ip: 144.208.126.50
- ip: 147.45.177.127
- ip: 168.100.8.84
- ip: 178.17.57.102
- ip: 178.17.57.103
- ip: 178.17.57.153
- ip: 185.125.50.125
- ip: 185.156.248.24
- ip: 185.196.11.171
- ip: 185.208.158.250
- ip: 185.236.20.154
- ip: 185.39.19.164
- ip: 185.39.19.180
- ip: 185.39.19.181
- ip: 185.39.19.94
- ip: 192.109.138.102
- ip: 192.124.178.74
- ip: 194.76.227.242
- ip: 195.149.146.118
- ip: 195.85.115.44
- ip: 31.58.50.160
- ip: 31.58.87.132
- ip: 45.11.180.174
- ip: 45.11.180.198
- ip: 45.11.183.165
- ip: 45.11.183.19
- ip: 45.11.183.45
- ip: 45.134.26.41
- ip: 45.135.232.149
- ip: 45.144.53.62
- ip: 45.61.136.81
- ip: 64.52.80.121
- ip: 67.217.228.198
- ip: 77.90.153.43
- ip: 78.153.155.131
- ip: 79.132.130.148
- ip: 79.132.131.200
- ip: 80.64.18.245
- ip: 80.77.25.114
- ip: 80.77.25.239
- ip: 80.77.25.88
- ip: 85.192.49.6
- ip: 85.208.84.115
- ip: 85.208.84.65
- ip: 87.120.93.167
- ip: 88.214.50.83
- ip: 91.202.233.132
- ip: 91.202.233.250
- ip: 94.141.122.164
- url: http://78.153.155.131/service/download/p2.tar
- url: http://boiksal.com/upd.
- url: https://catalyst.prodaft.com/public/report/understanding-current-castleloade
- url: https://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/o
- domain: alafair.net
- domain: albafood.shop
- domain: albalk.lol
- domain: anotherproject.icu
- domain: autryjones.com
- domain: bdeskthebest.shop
- domain: bestproxysale.shop
- domain: bestvpninfo.shop
- domain: bethschwier.com
- domain: bioskbd.com
- domain: blkiesf.com
- domain: boikfrs.com
- domain: boiksal.com
- domain: bookingnewprice109034.icu
- domain: bookingnewprice204167.icu
- domain: campanyasoft.com
- domain: castlppwnd.com
- domain: cdlfreightlogistics.com
- domain: checkinastayverify.com
- domain: checkinistayverify.com
- domain: checkinstayverify.com
- domain: checkistayverify.com
- domain: checksstayverify.com
- domain: checkystayverify.com
- domain: chessinthenight.lol
- domain: cik-ed.com
- domain: cking.com
- domain: clgenetics.shop
- domain: confirmahotelastay.com
- domain: confirmahotelstay.com
- domain: confirmhotelestay.com
- domain: confirmhotelistay.com
- domain: confirmhotelystay.com
- domain: confirmstayon.com
- domain: confirmstayonline.com
- domain: confirmyhotelstay.com
- domain: cut-gv.com
- domain: dip-bo.com
- domain: docusign.homes
- domain: dok-ol.com
- domain: donttouchme.life
- domain: donttouchthisisuseless.icu
- domain: doyoureallyseeme.icu
- domain: dpeformse.com
- domain: dperforms.info
- domain: dubaialbafood.shop
- domain: dut-cd.com
- domain: easyadvicesforyou.shop
- domain: easyprintscreen.shop
- domain: englandloglstics.com
- domain: englanglogistlcs.com
- domain: eta-cd.com
- domain: eto-sa.com
- domain: fir-vp.com
- domain: for-es.com
- domain: funjobcollins.shop
- domain: gabesworld.com
- domain: galaxioflow.com
- domain: gir-vc.com
- domain: guesitastayhotel.com
- domain: guest-request16433.com
- domain: guest-request44565494.com
- domain: guest-request64533.com
- domain: guest-request666543.com
- domain: guest-request677653.com
- domain: guest-update666532345.com
- domain: guestaformahub.com
- domain: guestaformhub.com
- domain: guestaformsafe.com
- domain: guestaportalverify.com
- domain: guestaverifyportal.com
- domain: guestformahub.com
- domain: guestformasafe.com
- domain: guestformhub.com
- domain: guestformsafe.com
- domain: guestistayhotel.com
- domain: guestportalverify.com
- domain: gueststayhotel.com
- domain: guestverifyhub.com
- domain: guestverifylink.com
- domain: guestverifyportal.com
- domain: guestystayhotel.com
- domain: guesutastayhotel.com
- domain: guesytastayhotel.com
- domain: gut-bk.com
- domain: her-op.com
- domain: hometownlogisticsllc.com
- domain: hoteliguestverify.com
- domain: hotelistayverify.com
- domain: hotelroomprice1039375.icu
- domain: hotelyguestverify.com
- domain: hotelystayverify.com
- domain: icantseeyou.icu
- domain: info-guest44567645.com
- domain: info676345677.com
- domain: ipk-sa.com
- domain: itp-ce.com
- domain: jshanoi.com
- domain: justnewdmain.com
- domain: kakapupuneww.com
- domain: kil-it.com
- domain: kip-er.com
- domain: leemanlogisticsinc.com
- domain: loadplannig.com
- domain: loads.icu
- domain: loadsplanning.com
- domain: loadsschedule.com
- domain: loadstracking.com
- domain: loadstrucking.com
- domain: mac-ig.com
- domain: map-nv.com
- domain: mcentireinc.com
- domain: mcloads.com
- domain: mechiraz.com
- domain: miteamss.com
- domain: mlxfreightinc.com
- domain: mrlogsol.ca
- domain: ned-uj.com
- domain: nedpihotel.com
- domain: newmessage10294.com
- domain: nimbusvaults.com
- domain: nort-secure.shop
- domain: norton-secure.shop
- domain: notstablecoin.xyz
- domain: notusdt.lol
- domain: nvidblog.shop
- domain: nvldlainfoblog.shop
- domain: oldspicenotsogood.shop
- domain: otr-gl.com
- domain: pilolhotel.com
- domain: pinaccletruckllc.com
- domain: pit-kp.com
- domain: programsbookss.com
- domain: rateconfirmations.com
- domain: rcpeformse.com
- domain: redlightninglogistics.com
- domain: redlightninglogisticsinc.com
- domain: request-info3444.com
- domain: request-info4433345.com
- domain: request345553.com
- domain: request44456776.com
- domain: roject0.com
- domain: rol-vd.com
- domain: roomiverifaccess.com
- domain: roomverifaccess.com
- domain: roomverifiaccess.com
- domain: servicehotelonline.com
- domain: site-bila.com
- domain: site-filo.com
- domain: site-here.com
- domain: site-reto.com
- domain: site-riko.com
- domain: site-sero.com
- domain: site-silo.com
- domain: site-tiko.com
- domain: site-tilo.com
- domain: site-wila.com
- domain: speatly.com
- domain: spu-cr.com
- domain: starkforeveryone.lol
- domain: starshiplogisticsgroupllc.com
- domain: sweetdevices.lol
- domain: tam-cg.com
- domain: tdbfvgwe456yt.com
- domain: tenderloads.com
- domain: testdomain123123.shop
- domain: touchmeplease.icu
- domain: tradeviewdesktop.shop
- domain: tradlngview-desktop.biz
- domain: tradlngvlewdesktop.shop
- domain: tradview-desktop.shop
- domain: treetankists.com
- domain: trucksscheduling.com
- domain: uke-sd.com
- domain: uki-fa.com
- domain: update-gues3429.com
- domain: update-guest4398317809.com
- domain: update-info14546.com
- domain: update-info3458421.com
- domain: update-info4467.com
- domain: update-info4468765.com
- domain: update-info539156.com
- domain: update-info71556.com
- domain: update-reques898665.com
- domain: verifihubguest.com
- domain: verifyhubguest.com
- domain: vipcinemade.shop
- domain: vipcinemadubai.shop
- domain: vipdubaicinema.shop
- domain: wal-ik.com
- domain: wereatwar.com
- domain: xut-uv.com
- domain: xyt-ko.com
- domain: ykl-vh.com
- domain: yt-ko.com
- domain: zit-fl.com
- domain: booking-porta.com
- domain: englandlogistics.com
- domain: apps.englandlogistics.rateconfirmations.com
- domain: catalyst.prodaft.com
- domain: files.loadstracking.com
- ip: 77.83.207.56
- cidr: 192.109.138.0/24
- ip: 192.109.138.103
- ip: 37.230.62.235
- ip: 85.208.84.242
- ip: 89.185.84.211
- ip: 94.159.113.123
- ip: 94.159.113.32
- url: http://boiksal.com/upd
- url: https://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/overview
- hash: 07d4f827724ce6c1b7cfd4d555dee89bbb1a2430
- hash: 4e25f8cd40b268cb76219e0d6fde475eb64a100b
- hash: 5b259f453136165223116203984a65f95c960497
- hash: d5061cef69f20321ca9bf64dfeae73778888f931
CastleLoader Activity Clusters Target Multiple Industries
Description
GrayBravo operates a malware-as-a-service model distributing CastleLoader malware through multiple distinct activity clusters targeting various industries. These clusters use phishing campaigns impersonating logistics firms and Booking. com, leveraging the ClickFix technique to deliver malware. The threat actor demonstrates rapid evolution and technical sophistication, adapting quickly to public exposure. While no known exploits in the wild are reported, the malware's distribution methods and impersonation tactics pose significant risks to confidentiality and operational integrity. European organizations in logistics, travel, and e-commerce sectors are particularly at risk due to targeted impersonations. Mitigation requires tailored phishing defenses, enhanced email filtering, user training focused on specific lures, and monitoring for CastleLoader indicators. Countries with significant logistics and travel industries, such as Germany, the UK, France, and the Netherlands, are most likely affected. The threat is assessed as medium severity given its phishing-based delivery, lack of known exploits, and targeted scope.
AI-Powered Analysis
Technical Analysis
The GrayBravo threat actor group operates a malware-as-a-service (MaaS) model centered around CastleLoader, a sophisticated malware family. Insikt Group has identified four distinct activity clusters linked to GrayBravo, each with unique tactics and victim profiles, indicating a modular and adaptable operation. Two notable clusters, TAG-160 and TAG-161, impersonate logistics companies and Booking.com respectively, using phishing campaigns that employ the ClickFix technique to distribute CastleLoader. ClickFix involves embedding malicious payloads or links within seemingly legitimate communications to bypass traditional security filters. The malware itself is part of a broader ecosystem including CastleRAT, CastleBot, and other tools, suggesting a comprehensive toolkit supporting various attack stages. GrayBravo’s rapid evolution and adaptability allow it to modify tactics in response to public exposure, increasing its resilience. Although no known exploits are currently reported in the wild, the phishing-based infection vector and impersonation of trusted brands increase the likelihood of successful compromise. The threat actor’s ties to the online persona “Sparja” and the wider cybercriminal ecosystem highlight potential collaboration and resource sharing, enhancing operational capabilities. The report underscores the importance of targeted defenses against these phishing lures and the need for continuous monitoring of CastleLoader-related activity.
Potential Impact
European organizations, especially those in logistics, travel, and e-commerce sectors, face significant risks from GrayBravo’s CastleLoader campaigns. Successful phishing attacks can lead to malware installation, resulting in data exfiltration, credential theft, and potential lateral movement within networks. This compromises confidentiality and integrity of sensitive business and customer data. Operational disruptions may occur if malware affects critical systems, impacting availability. The impersonation of well-known brands like Booking.com increases the likelihood of user interaction, raising the risk of initial compromise. Given the MaaS model, multiple organizations across industries could be targeted simultaneously, amplifying the threat’s scale. The adaptability of GrayBravo means defenses must continuously evolve to counter new tactics. For European entities, breaches could also have regulatory repercussions under GDPR due to potential data leaks. The medium severity reflects the balance between the threat’s sophistication and the reliance on phishing vectors, which can be mitigated with proper controls.
Mitigation Recommendations
1. Implement advanced email filtering solutions capable of detecting and blocking phishing emails that use brand impersonation and ClickFix techniques. 2. Conduct targeted user awareness training focusing on recognizing phishing lures related to logistics firms and Booking.com, emphasizing the risks of interacting with unexpected links or attachments. 3. Deploy endpoint detection and response (EDR) tools to identify and contain CastleLoader malware activity promptly. 4. Monitor network traffic for indicators of compromise associated with CastleLoader and related tools like CastleRAT and CastleBot. 5. Enforce multi-factor authentication (MFA) across all user accounts to reduce the impact of credential theft. 6. Maintain up-to-date threat intelligence feeds to stay informed about evolving GrayBravo tactics and indicators. 7. Establish incident response plans specifically addressing phishing and malware infections linked to MaaS operations. 8. Collaborate with industry peers and information sharing organizations to exchange intelligence on emerging threats and mitigation strategies. 9. Regularly audit and restrict permissions to limit malware lateral movement within networks. 10. Verify the authenticity of communications purporting to be from logistics or travel companies through out-of-band channels before acting on requests.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries"]
- Adversary
- GrayBravo
- Pulse Id
- 6937b6169bd435b2e3a0787e
- Threat Score
- null
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip185.149.146.118 | — | |
ip185.196.9.222 | — | |
ip185.196.10.8 | — | |
ip185.196.9.80 | — | |
ip192.153.57.125 | — | |
ip45.155.249.121 | — | |
ip77.83.207.55 | — | |
ip104.225.129.171 | — | |
ip144.208.126.50 | — | |
ip147.45.177.127 | — | |
ip168.100.8.84 | — | |
ip178.17.57.102 | — | |
ip178.17.57.103 | — | |
ip178.17.57.153 | — | |
ip185.125.50.125 | — | |
ip185.156.248.24 | — | |
ip185.196.11.171 | — | |
ip185.208.158.250 | — | |
ip185.236.20.154 | — | |
ip185.39.19.164 | — | |
ip185.39.19.180 | — | |
ip185.39.19.181 | — | |
ip185.39.19.94 | — | |
ip192.109.138.102 | — | |
ip192.124.178.74 | — | |
ip194.76.227.242 | — | |
ip195.149.146.118 | — | |
ip195.85.115.44 | — | |
ip31.58.50.160 | — | |
ip31.58.87.132 | — | |
ip45.11.180.174 | — | |
ip45.11.180.198 | — | |
ip45.11.183.165 | — | |
ip45.11.183.19 | — | |
ip45.11.183.45 | — | |
ip45.134.26.41 | — | |
ip45.135.232.149 | — | |
ip45.144.53.62 | — | |
ip45.61.136.81 | — | |
ip64.52.80.121 | — | |
ip67.217.228.198 | — | |
ip77.90.153.43 | — | |
ip78.153.155.131 | — | |
ip79.132.130.148 | — | |
ip79.132.131.200 | — | |
ip80.64.18.245 | — | |
ip80.77.25.114 | — | |
ip80.77.25.239 | — | |
ip80.77.25.88 | — | |
ip85.192.49.6 | — | |
ip85.208.84.115 | — | |
ip85.208.84.65 | — | |
ip87.120.93.167 | — | |
ip88.214.50.83 | — | |
ip91.202.233.132 | — | |
ip91.202.233.250 | — | |
ip94.141.122.164 | — | |
ip77.83.207.56 | — | |
ip192.109.138.103 | — | |
ip37.230.62.235 | — | |
ip85.208.84.242 | — | |
ip89.185.84.211 | — | |
ip94.159.113.123 | — | |
ip94.159.113.32 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash35f81d066028f5e69508956bed79d3ee | — | |
hash4b139d1e079eb10ffd2543e22ea438dd | — | |
hasha0e6555acf7d7a273b76067f89884705 | — | |
hashc581969dc1561794c9b0adedbf2ac492 | — | |
hashf8fae59f47f269cb4ee50e701fddc76c | — | |
hash47edb5743df7747fccdcd64421dd64a92f24d1fc | — | |
hash634c051e17eec0345f0db57f364741603bd1929f | — | |
hash861fa0a2edec4b773852029abea4b03ba17f181d | — | |
hashae1a8e192b8416b72da711dbd8b32eaf80d788e3 | — | |
hashf278f8326aa5d63161d6648b41e1b3b8ba077061 | — | |
hash058d83fd8834246d6d2a2771e6e0aeb4d4ef8a6984cbe1133f3a569029a4b1f7 | — | |
hash190e673787bfc6e8eeebccd64c8da61747d5be06f87d3aea879118ef1a9f4836 | — | |
hash1b6befc65b19a63b4131ce5bcc6e8c0552fe1e1d136ab94bc7d81b3924056156 | — | |
hash1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75 | — | |
hash202f6b6631ade2c41e4762e5877ce0063a3beabce0c3f8564b6499a1164c1e04 | — | |
hash25e0008aba82690e0f58c9d9fcfbc5d49820aa78d2f7bfcd0b85fb969180fc04 | — | |
hash53775af67e9df206ed3f9c0a3756dbbc4968a77b1df164e9baddb51e61ac82df | — | |
hash60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0 | — | |
hash6444f0e3f78254aef663837562d258a2236a77f810ee8d832de7d83e0fdd5783 | — | |
hash67cf6d5332078ff021865d5fef6dc61e90b89bc411d8344754247ccd194ff65b | — | |
hash94dc0f696a46f3c225b0aa741fbd3b8997a92126d66d7bc7c9dd8097af0de52a | — | |
hash963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d | — | |
hashb45cce4ede6ffb7b6f28f75a0cbb60e65592840d98dcb63155b9fa0324a88be2 | — | |
hashcf202498b85e6f0ae4dffae1a65acbfec78cc39fce71f831d45f916c7dedfa0c | — | |
hashd87ccd5a2911e46a1efbc0ef0cfe095f136de98df055eacd1c82de76ae6fecec | — | |
hashe6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928 | — | |
hashfb9de7448e9e30f717c171f1d1c90ac72828803a16ad385757aeecc853479d3c | — | |
hash07d4f827724ce6c1b7cfd4d555dee89bbb1a2430 | — | |
hash4e25f8cd40b268cb76219e0d6fde475eb64a100b | — | |
hash5b259f453136165223116203984a65f95c960497 | — | |
hashd5061cef69f20321ca9bf64dfeae73778888f931 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://78.153.155.131/service/download/p2.tar | — | |
urlhttp://boiksal.com/upd. | — | |
urlhttps://catalyst.prodaft.com/public/report/understanding-current-castleloade | — | |
urlhttps://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/o | — | |
urlhttp://boiksal.com/upd | — | |
urlhttps://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/overview | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainalafair.net | — | |
domainalbafood.shop | — | |
domainalbalk.lol | — | |
domainanotherproject.icu | — | |
domainautryjones.com | — | |
domainbdeskthebest.shop | — | |
domainbestproxysale.shop | — | |
domainbestvpninfo.shop | — | |
domainbethschwier.com | — | |
domainbioskbd.com | — | |
domainblkiesf.com | — | |
domainboikfrs.com | — | |
domainboiksal.com | — | |
domainbookingnewprice109034.icu | — | |
domainbookingnewprice204167.icu | — | |
domaincampanyasoft.com | — | |
domaincastlppwnd.com | — | |
domaincdlfreightlogistics.com | — | |
domaincheckinastayverify.com | — | |
domaincheckinistayverify.com | — | |
domaincheckinstayverify.com | — | |
domaincheckistayverify.com | — | |
domainchecksstayverify.com | — | |
domaincheckystayverify.com | — | |
domainchessinthenight.lol | — | |
domaincik-ed.com | — | |
domaincking.com | — | |
domainclgenetics.shop | — | |
domainconfirmahotelastay.com | — | |
domainconfirmahotelstay.com | — | |
domainconfirmhotelestay.com | — | |
domainconfirmhotelistay.com | — | |
domainconfirmhotelystay.com | — | |
domainconfirmstayon.com | — | |
domainconfirmstayonline.com | — | |
domainconfirmyhotelstay.com | — | |
domaincut-gv.com | — | |
domaindip-bo.com | — | |
domaindocusign.homes | — | |
domaindok-ol.com | — | |
domaindonttouchme.life | — | |
domaindonttouchthisisuseless.icu | — | |
domaindoyoureallyseeme.icu | — | |
domaindpeformse.com | — | |
domaindperforms.info | — | |
domaindubaialbafood.shop | — | |
domaindut-cd.com | — | |
domaineasyadvicesforyou.shop | — | |
domaineasyprintscreen.shop | — | |
domainenglandloglstics.com | — | |
domainenglanglogistlcs.com | — | |
domaineta-cd.com | — | |
domaineto-sa.com | — | |
domainfir-vp.com | — | |
domainfor-es.com | — | |
domainfunjobcollins.shop | — | |
domaingabesworld.com | — | |
domaingalaxioflow.com | — | |
domaingir-vc.com | — | |
domainguesitastayhotel.com | — | |
domainguest-request16433.com | — | |
domainguest-request44565494.com | — | |
domainguest-request64533.com | — | |
domainguest-request666543.com | — | |
domainguest-request677653.com | — | |
domainguest-update666532345.com | — | |
domainguestaformahub.com | — | |
domainguestaformhub.com | — | |
domainguestaformsafe.com | — | |
domainguestaportalverify.com | — | |
domainguestaverifyportal.com | — | |
domainguestformahub.com | — | |
domainguestformasafe.com | — | |
domainguestformhub.com | — | |
domainguestformsafe.com | — | |
domainguestistayhotel.com | — | |
domainguestportalverify.com | — | |
domaingueststayhotel.com | — | |
domainguestverifyhub.com | — | |
domainguestverifylink.com | — | |
domainguestverifyportal.com | — | |
domainguestystayhotel.com | — | |
domainguesutastayhotel.com | — | |
domainguesytastayhotel.com | — | |
domaingut-bk.com | — | |
domainher-op.com | — | |
domainhometownlogisticsllc.com | — | |
domainhoteliguestverify.com | — | |
domainhotelistayverify.com | — | |
domainhotelroomprice1039375.icu | — | |
domainhotelyguestverify.com | — | |
domainhotelystayverify.com | — | |
domainicantseeyou.icu | — | |
domaininfo-guest44567645.com | — | |
domaininfo676345677.com | — | |
domainipk-sa.com | — | |
domainitp-ce.com | — | |
domainjshanoi.com | — | |
domainjustnewdmain.com | — | |
domainkakapupuneww.com | — | |
domainkil-it.com | — | |
domainkip-er.com | — | |
domainleemanlogisticsinc.com | — | |
domainloadplannig.com | — | |
domainloads.icu | — | |
domainloadsplanning.com | — | |
domainloadsschedule.com | — | |
domainloadstracking.com | — | |
domainloadstrucking.com | — | |
domainmac-ig.com | — | |
domainmap-nv.com | — | |
domainmcentireinc.com | — | |
domainmcloads.com | — | |
domainmechiraz.com | — | |
domainmiteamss.com | — | |
domainmlxfreightinc.com | — | |
domainmrlogsol.ca | — | |
domainned-uj.com | — | |
domainnedpihotel.com | — | |
domainnewmessage10294.com | — | |
domainnimbusvaults.com | — | |
domainnort-secure.shop | — | |
domainnorton-secure.shop | — | |
domainnotstablecoin.xyz | — | |
domainnotusdt.lol | — | |
domainnvidblog.shop | — | |
domainnvldlainfoblog.shop | — | |
domainoldspicenotsogood.shop | — | |
domainotr-gl.com | — | |
domainpilolhotel.com | — | |
domainpinaccletruckllc.com | — | |
domainpit-kp.com | — | |
domainprogramsbookss.com | — | |
domainrateconfirmations.com | — | |
domainrcpeformse.com | — | |
domainredlightninglogistics.com | — | |
domainredlightninglogisticsinc.com | — | |
domainrequest-info3444.com | — | |
domainrequest-info4433345.com | — | |
domainrequest345553.com | — | |
domainrequest44456776.com | — | |
domainroject0.com | — | |
domainrol-vd.com | — | |
domainroomiverifaccess.com | — | |
domainroomverifaccess.com | — | |
domainroomverifiaccess.com | — | |
domainservicehotelonline.com | — | |
domainsite-bila.com | — | |
domainsite-filo.com | — | |
domainsite-here.com | — | |
domainsite-reto.com | — | |
domainsite-riko.com | — | |
domainsite-sero.com | — | |
domainsite-silo.com | — | |
domainsite-tiko.com | — | |
domainsite-tilo.com | — | |
domainsite-wila.com | — | |
domainspeatly.com | — | |
domainspu-cr.com | — | |
domainstarkforeveryone.lol | — | |
domainstarshiplogisticsgroupllc.com | — | |
domainsweetdevices.lol | — | |
domaintam-cg.com | — | |
domaintdbfvgwe456yt.com | — | |
domaintenderloads.com | — | |
domaintestdomain123123.shop | — | |
domaintouchmeplease.icu | — | |
domaintradeviewdesktop.shop | — | |
domaintradlngview-desktop.biz | — | |
domaintradlngvlewdesktop.shop | — | |
domaintradview-desktop.shop | — | |
domaintreetankists.com | — | |
domaintrucksscheduling.com | — | |
domainuke-sd.com | — | |
domainuki-fa.com | — | |
domainupdate-gues3429.com | — | |
domainupdate-guest4398317809.com | — | |
domainupdate-info14546.com | — | |
domainupdate-info3458421.com | — | |
domainupdate-info4467.com | — | |
domainupdate-info4468765.com | — | |
domainupdate-info539156.com | — | |
domainupdate-info71556.com | — | |
domainupdate-reques898665.com | — | |
domainverifihubguest.com | — | |
domainverifyhubguest.com | — | |
domainvipcinemade.shop | — | |
domainvipcinemadubai.shop | — | |
domainvipdubaicinema.shop | — | |
domainwal-ik.com | — | |
domainwereatwar.com | — | |
domainxut-uv.com | — | |
domainxyt-ko.com | — | |
domainykl-vh.com | — | |
domainyt-ko.com | — | |
domainzit-fl.com | — | |
domainbooking-porta.com | — | |
domainenglandlogistics.com | — | |
domainapps.englandlogistics.rateconfirmations.com | — | |
domaincatalyst.prodaft.com | — | |
domainfiles.loadstracking.com | — |
Cidr
| Value | Description | Copy |
|---|---|---|
cidr192.109.138.0/24 | — |
Threat ID: 693819561b76610347bfb3b1
Added to database: 12/9/2025, 12:43:02 PM
Last enriched: 12/9/2025, 12:58:01 PM
Last updated: 12/11/2025, 5:41:07 AM
Views: 114
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
ThreatFox IOCs for 2025-12-10
MediumReact2Shell Exploitation Delivers Crypto Miners and New Malware Across Multiple Sectors
MediumNorth Korean Hackers Deploy EtherRAT Malware in React2Shell Exploits
MediumFinding Minhook in a sideloading attack – and Sweden too
MediumAI-Poisoning & AMOS Stealer: How Trust Became the Biggest Mac Threat
MediumActions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.