CastleLoader Malware-as-a-Service: GrayBravo's Expanding Threat Infrastructure скачать в хорошем качестве

CastleLoader Malware-as-a-Service: GrayBravo's Expanding Threat Infrastructure

Researchers have identified four distinct threat clusters leveraging the CastleLoader malware loader, indicating its use as a Malware-as-a-Service (MaaS) offering by the group GrayBravo (formerly TAG-150). GrayBravo demonstrates rapid development, technical skill, and responsiveness to public reports. Their toolkit includes CastleRAT and CastleBot, which distributes malware like DeerStealer, RedLine Stealer, StealC Stealer, NetSupport RAT, SectopRAT, MonsterV2, and WARMCOOKIE. Four activity clusters were observed: Logistics sector targeting via phishing (TAG-160). -themed ClickFix campaigns (TAG-161) distributing CastleLoader and Matanbuchus 3.0. impersonation delivering CastleRAT via CastleLoader. Malvertising and fake software updates distributing CastleLoader and NetSupport RAT. GrayBravo uses a multi-tiered infrastructure, including victim-facing C2 servers and backup VPS servers. TAG-160 uses fraudulent accounts on freight platforms to enhance phishing campaigns. This highlights the rapid proliferation of effective and adaptive malware tools within the cybercriminal ecosystem.