MalwarePublished 15 Dec 2025Updated 14 Jan 2026

Snakes in the Castle: Inside the Walls of Python-Driven CastleLoader Delivery

Source AlienVault OTX General

Description

The Blackpoint SOC recently responded to an incident initiated through the tried-and-true ClickFix technique; a social engineering method consistently leveraged across numerous campaigns this past year. These lures convince users to press Win + R to open the Windows Run dialog box, then enter a command presented as a harmless “human verification” step or similar prompt. This pattern has been repeatedly used to deploy everything from information stealers to remote access trojans (RATs), and it has also become one of the primary delivery vectors for a newer loader family known as CastleLoader.

Impact

For European organizations, the CastleLoader threat poses a risk primarily through successful social engineering that leads to malware execution. If deployed, CastleLoader can facilitate the installation of information stealers or RATs, potentially compromising sensitive data confidentiality and enabling unauthorized remote access. This could lead to data breaches, espionage, or lateral movement within networks. The use of Python scripts may allow attackers to adapt payloads quickly, complicating detection and response efforts. The threat is particularly concerning for sectors with high-value data or critical infrastructure, as attackers could leverage access for espionage or disruption. The requirement for user interaction reduces the likelihood of widespread automated infection but does not eliminate risk, especially in environments with insufficient user training or endpoint protections. The presence of command-and-control infrastructure linked to Russia may also raise geopolitical concerns, potentially targeting organizations involved in sectors sensitive to Eastern European cyber operations. Overall, the impact includes potential loss of data confidentiality, integrity, and availability, with moderate difficulty in exploitation due to social engineering dependence.

Defensive guidance

To mitigate CastleLoader threats, European organizations should implement targeted user awareness training focused on the dangers of social engineering techniques like ClickFix, emphasizing the risks of executing unsolicited commands via the Run dialog. Endpoint detection and response (EDR) solutions should be configured to monitor and alert on suspicious use of the Windows Run dialog and unusual Python script executions. Network defenses should block or closely monitor traffic to known malicious domains and IP addresses such as dperforms.info and 78.153.155.131. Application whitelisting can prevent unauthorized execution of unknown scripts or binaries. Multi-factor authentication and strict privilege management reduce the impact of potential RAT deployments. Incident response plans should include procedures for rapid containment and forensic analysis of infections involving CastleLoader. Regular threat intelligence updates should be consumed to stay informed about evolving indicators and tactics. Finally, disabling or restricting the use of the Windows Run dialog for non-administrative users where feasible can reduce the attack surface.

Indicators of compromise

Domains 1

dperforms.info

URLs 2

http://78.153.155.131/service/download/p2.tar
http://dperforms.info/service/download/load_1

IP addresses 1

CC=RU ASN=AS45027 llc internet tehnologii

78.153.155.131

Hashes 3

0f5c3ac4b4f997acd2cd71c451082cd8fbd1cbdb1a6db2bdf470714f2e7ef4bb
8a539355d317bd8a490f470319410e5d2a2851a38828c900f357fbac9083583c
bfea06a7ef5b25b40178cfffd802d8ab4f5ee35ca5cd8d2b9ff29b4e201b3b7f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Dec 2025, 09:30 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details