MalwarePublished 9 Dec 2025Updated 6 Mar 2026

CastleLoader Activity Clusters Target Multiple Industries

Source AlienVault OTX General

Description

Insikt Group has identified four distinct activity clusters associated with GrayBravo's CastleLoader malware, each with unique tactics and victim profiles. This supports the assessment that GrayBravo operates a malware-as-a-service model. One cluster, TAG-160, impersonates logistics firms and uses phishing lures with the ClickFix technique to distribute CastleLoader. Another cluster, TAG-161, impersonates Booking.com and employs similar techniques. The analysis also uncovered potential links to the online persona "Sparja" and the broader cybercriminal ecosystem. GrayBravo demonstrates rapid evolution, technical sophistication, and adaptability in response to public exposure. The report recommends various security measures to defend against these threats.

Impact

European organizations, especially those in logistics, travel, and e-commerce sectors, face significant risks from GrayBravo’s CastleLoader campaigns. Successful phishing attacks can lead to malware installation, resulting in data exfiltration, credential theft, and potential lateral movement within networks. This compromises confidentiality and integrity of sensitive business and customer data. Operational disruptions may occur if malware affects critical systems, impacting availability. The impersonation of well-known brands like Booking.com increases the likelihood of user interaction, raising the risk of initial compromise. Given the MaaS model, multiple organizations across industries could be targeted simultaneously, amplifying the threat’s scale. The adaptability of GrayBravo means defenses must continuously evolve to counter new tactics. For European entities, breaches could also have regulatory repercussions under GDPR due to potential data leaks. The medium severity reflects the balance between the threat’s sophistication and the reliance on phishing vectors, which can be mitigated with proper controls.

Defensive guidance

1. Implement advanced email filtering solutions capable of detecting and blocking phishing emails that use brand impersonation and ClickFix techniques. 2. Conduct targeted user awareness training focusing on recognizing phishing lures related to logistics firms and Booking.com, emphasizing the risks of interacting with unexpected links or attachments. 3. Deploy endpoint detection and response (EDR) tools to identify and contain CastleLoader malware activity promptly. 4. Monitor network traffic for indicators of compromise associated with CastleLoader and related tools like CastleRAT and CastleBot. 5. Enforce multi-factor authentication (MFA) across all user accounts to reduce the impact of credential theft. 6. Maintain up-to-date threat intelligence feeds to stay informed about evolving GrayBravo tactics and indicators. 7. Establish incident response plans specifically addressing phishing and malware infections linked to MaaS operations. 8. Collaborate with industry peers and information sharing organizations to exchange intelligence on emerging threats and mitigation strategies. 9. Regularly audit and restrict permissions to limit malware lateral movement within networks. 10. Verify the authenticity of communications purporting to be from logistics or travel companies through out-of-band channels before acting on requests.

Indicators of compromise

Domains 201

alafair.net
albafood.shop
albalk.lol
anotherproject.icu
autryjones.com
bdeskthebest.shop
bestproxysale.shop
bestvpninfo.shop
bethschwier.com
bioskbd.com

URLs 6

http://78.153.155.131/service/download/p2.tar
http://boiksal.com/upd.
https://catalyst.prodaft.com/public/report/understanding-current-castleloade
https://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/o
http://boiksal.com/upd
https://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/overview

IP addresses 64

185.149.146.118
185.196.9.222
185.196.10.8
185.196.9.80
192.153.57.125
45.155.249.121
77.83.207.55
104.225.129.171
144.208.126.50
147.45.177.127

Hashes 31

35f81d066028f5e69508956bed79d3ee
4b139d1e079eb10ffd2543e22ea438dd
a0e6555acf7d7a273b76067f89884705
c581969dc1561794c9b0adedbf2ac492
f8fae59f47f269cb4ee50e701fddc76c
47edb5743df7747fccdcd64421dd64a92f24d1fc
634c051e17eec0345f0db57f364741603bd1929f
861fa0a2edec4b773852029abea4b03ba17f181d
ae1a8e192b8416b72da711dbd8b32eaf80d788e3
f278f8326aa5d63161d6648b41e1b3b8ba077061

Cidr 1

192.109.138.0/24

Community reviews

Loading reviews…