MalwarePublished 13 Aug 2025

CastleLoader Analysis

Source AlienVault OTX General

Description

CastleLoader, a versatile malware loader, has infected 469 devices since May 2025 using Cloudflare-themed ClickFix phishing and fake GitHub repositories. It delivers information stealers and RATs, with a 28.7% infection rate. The malware employs sophisticated techniques, including PowerShell and AutoIT scripts, to load shellcode into memory and connect to C2 servers. CastleLoader's modular design allows deployment of multiple payloads, including StealC, RedLine, NetSupport RAT, DeerStealer, HijackLoader, and SectopRAT. Its campaigns target U.S.government entities and use legitimate file-sharing services and compromised websites for payload retrieval, enhancing resilience against takedowns.

Impact

For European organizations, CastleLoader poses a significant threat due to its capability to deliver information stealers and RATs that can exfiltrate sensitive data, compromise credentials, and enable persistent remote access. The modular nature of the loader means attackers can tailor payloads to specific targets, increasing the risk of espionage, intellectual property theft, and disruption of critical infrastructure. The use of phishing and fake repositories as infection vectors exploits common user behaviors, making it a widespread risk across sectors. Additionally, the malware’s ability to evade detection by loading payloads in memory and leveraging legitimate services for payload retrieval complicates incident response and forensic analysis. European government agencies, critical infrastructure providers, and private sector companies involved in technology, finance, and research are particularly at risk, as attackers may seek to replicate the targeting seen in U.S. government campaigns. The infection could lead to data breaches, operational disruptions, and reputational damage, with potential regulatory consequences under GDPR if personal data is compromised.

Defensive guidance

European organizations should implement targeted defenses against CastleLoader by focusing on the following measures: 1) Enhance phishing detection and user awareness training specifically addressing Cloudflare-themed and fake GitHub repository lures to reduce the likelihood of initial infection. 2) Deploy advanced endpoint detection and response (EDR) solutions capable of detecting in-memory execution techniques such as PowerShell and AutoIT script abuse, and monitor for suspicious process injection behaviors. 3) Implement strict application whitelisting and script execution policies to limit unauthorized PowerShell and AutoIT script execution. 4) Monitor network traffic for unusual connections to known C2 infrastructure and legitimate file-sharing services used for payload delivery, employing threat intelligence feeds to update detection rules. 5) Conduct regular threat hunting exercises focusing on indicators of compromise related to CastleLoader and its associated payloads. 6) Harden user privilege management to prevent unauthorized persistence mechanisms and lateral movement. 7) Maintain up-to-date backups and incident response plans tailored to malware infections involving RATs and information stealers. 8) Collaborate with national cybersecurity centers and share threat intelligence to stay informed about emerging CastleLoader campaigns and indicators.

CastleLoader Analysis

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 1

Community reviews

Description

AI analysisMachine-generated, updated 13 Aug 2025, 16:04 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Hashes 1

Community reviews

Related threats