MalwarePublished 11 Mar 2026Updated 10 Apr 2026

CastleRAT attack first to abuse Deno JavaScript runtime to evade enterprise security

Source AlienVault OTX General

Description

A sophisticated infection chain has been discovered that installs CastleRAT malware without leaving traces on disk. The attack uniquely abuses the Deno runtime as a malicious framework, combining social engineering, steganography, and in-memory execution to evade detection. The process involves tricking users into executing a command, installing Deno, running obfuscated JavaScript, and decoding a payload hidden in a JPEG image. CastleRAT then gains total control, performing host fingerprinting, keylogging, clipboard hijacking, digital identity theft, and audio/video surveillance. This campaign demonstrates the evolution of malware towards invisibility and the need for advanced endpoint behavioral monitoring to detect such threats.

Impact

Organizations worldwide face significant risks from this CastleRAT campaign due to its stealthy infection vector and advanced evasion techniques. The in-memory execution without disk artifacts severely limits detection by traditional antivirus and endpoint protection platforms, increasing the likelihood of prolonged undetected presence. The malware’s capabilities—keylogging, clipboard hijacking, digital identity theft, and audio/video surveillance—pose severe confidentiality and privacy risks, potentially leading to data breaches, intellectual property theft, and espionage. Host fingerprinting enables attackers to tailor further attacks or lateral movement within networks. Enterprises relying on user trust and manual execution of commands are particularly vulnerable to social engineering exploitation. The campaign’s use of a legitimate runtime (Deno) complicates detection and response, potentially impacting sectors with high-value targets such as finance, government, healthcare, and technology. The stealth and persistence of CastleRAT could disrupt business operations and damage organizational reputation if sensitive data or communications are compromised.

Defensive guidance

To mitigate the threat posed by CastleRAT, organizations should implement multi-layered defenses focusing on behavioral and runtime analysis rather than solely signature-based detection. Specifically: 1) Enforce strict application whitelisting policies that restrict unauthorized installation and execution of runtimes like Deno, especially from untrusted sources. 2) Deploy advanced endpoint detection and response (EDR) solutions capable of monitoring in-memory execution, API abuse, and anomalous process behaviors. 3) Implement network monitoring to detect suspicious communications to known malicious IPs and domains such as 23.94.145.120, serialmenot.com, and dsennbuappec.zhivachkapro.com. 4) Educate users to recognize and resist social engineering attempts, particularly commands prompting runtime installations or execution of scripts. 5) Utilize steganalysis tools to inspect suspicious image files in email attachments or downloads. 6) Regularly audit and restrict permissions to prevent unauthorized runtime installations and script executions. 7) Employ multi-factor authentication and credential hygiene to reduce the impact of credential theft. 8) Conduct memory forensics and behavioral analytics to identify indicators of in-memory malware activity. 9) Maintain up-to-date threat intelligence feeds to incorporate emerging indicators and tactics. 10) Establish incident response playbooks tailored to runtime abuse and in-memory malware scenarios.

Indicators of compromise

Domains 2

serialmenot.com
dsennbuappec.zhivachkapro.com

IP addresses 1

23.94.145.120

Hashes 4

ca37e31d651bbd5bbddef3ea716b8b4f
de9707a8505683930fccf5536e311242425d420a
a4787a42070994b7f1222025828faf9b153710bb730e58da710728e148282e28
bd8203ab88983bc081545ff325f39e9c5cd5eb6a99d04ae2a6cf862535c9829a

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Mar 2026, 09:20 UTC

MITRE ATT&CK techniques21 from threat tags

Technical details

Indicators of compromise

Domains 2

IP addresses 1

Hashes 4

Community reviews

Related threats