TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations
Source Reddit InfoSec News
Germany
France
Italy
Netherlands
Spain
Poland
United Kingdom- infosecnews
- high-priority
- thehackernews.com
- malware
- cybersecurity
Description
TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations Source: https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html
Impact
For European organizations, the introduction of CastleRAT by TAG-150 could have significant security implications. Given the RAT's capabilities, infected systems could face unauthorized data access, espionage, disruption of operations, and potential compromise of sensitive information. Sectors such as finance, government, critical infrastructure, and technology firms in Europe are particularly at risk due to their strategic importance and the value of their data. The malware's ability to operate across platforms (suggested by Python usage) increases the attack surface, potentially affecting diverse IT environments common in European enterprises. Additionally, the stealth and persistence typical of RATs could enable prolonged undetected presence, complicating incident response and remediation efforts. Although no active exploitation is confirmed, European organizations should consider the threat credible and prepare accordingly, especially given the geopolitical climate and the history of targeted cyber operations in the region.
Defensive guidance
European organizations should implement targeted defenses against CastleRAT by: 1) Enhancing endpoint detection and response (EDR) solutions to identify suspicious behaviors typical of RATs, such as unusual process spawning, network connections to unknown C2 servers, and unauthorized script executions. 2) Conducting threat hunting exercises focused on detecting Python and C-based malware artifacts, including anomalous interpreter usage and native code injections. 3) Applying strict application whitelisting and script execution policies to limit unauthorized code execution. 4) Ensuring network segmentation to contain potential lateral movement and monitoring outbound traffic for anomalies. 5) Regularly updating and patching systems to reduce exploitable vulnerabilities that could serve as initial infection vectors. 6) Training security teams on emerging threats from TAG-150 and incorporating intelligence feeds that might provide early indicators of compromise related to CastleRAT. 7) Implementing multi-factor authentication and least privilege principles to reduce the impact of compromised credentials. These measures, combined with proactive monitoring and incident response readiness, will help mitigate the risk posed by this evolving malware threat.
Summary
TAG-150, a threat actor group, has developed a new malware variant named CastleRAT, implemented in both Python and C programming languages. This development represents an expansion of their existing CastleLoader malware operations. CastleRAT is a Remote Access Trojan (RAT), which typically allows attackers to gain persistent, stealthy access to compromised systems, enabling data exfiltration, system manipulation, and further lateral movement within networks. The dual-language implementation suggests an effort to increase the malware's versatility and evasion capabilities, as Python can facilitate rapid development and cross-platform compatibility, while C can provide low-level system access and performance advantages. Although specific technical details such as infection vectors, command and control (C2) infrastructure, or payload capabilities are not provided, the emergence of CastleRAT indicates an evolution in TAG-150's toolkit, potentially increasing the sophistication and impact of their campaigns. The malware's development and deployment are recent, with minimal public discussion and no known exploits in the wild reported yet, but the high severity rating underscores the potential threat posed by this new tool.
- Source Type
- Subreddit
- InfoSecNews
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Domain
- thehackernews.com
- Has External Source
- true
References
Community reviews
Related threats
- Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution ChainMalware
- Technology that blocks DGA domains | Kaspersky official blogAnalysis
- Infostealer riding the AI TrainMalware
- LiteLLM release pipeline hacked to distribute info-stealer malwareMalware
- Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affectedBreach