# CastleLoader

Malware-as-a-service loader · Also tracked as CastleBot · First seen early 2025 ·

## Overview

CastleLoader is a Windows-targeting malware-as-a-service framework active since early 2025. Public malware analysis tracks the same malware family as CastleBot and documents it as a three-component framework: a shellcode stager, a PE loader, and a core backdoor. TAG-150 is associated with CastleLoader activity and a related remote access trojan family called CastleRAT (Python variant: PyNightshade).

The framework's job is narrow: get a foothold on a clean Windows endpoint, fingerprint the host, register with the C2, and execute whichever secondary payload the operator schedules. Confirmed delivered payloads include NetSupport RAT, WARMCOOKIE (BadSpace), DeerStealer, RedLine, StealC, SectopRAT, Hijack Loader, MonsterV2 (Aurotun Stealer), Rhadamanthys, and Remcos. An eleventh — a custom .NET stealer named "CastleStealer" — was documented in April 2026. Public reporting notes that NetSupport and WARMCOOKIE have prior links to ransomware operators, which positions CastleLoader as a credible upstream component in current ransomware kill chains even though it does not deploy ransomware itself.

Operationally, CastleLoader is significant because it removes the disk artifact from initial access. Public reporting documents 1,634 infection attempts and 469 confirmed compromises in the May—July 2025 window — a 28.7% conversion rate, an unusually high success rate for a loader. Targeting has been broad but consistent: US government agencies, IT services firms, logistics, and critical infrastructure across North America and Europe.

CastleLoader does not appear in dark-web marketplaces. Public reporting has found no evidence of open advertising, suggesting a closed affiliate model — vetted operators only — which makes attribution harder but does not slow distribution.

### Threat profile

Updated May 11, 2026

| Field | Value |
|---|---|
| Type | Loader (MaaS) |
| First seen | Early 2025 |
| Operator | TAG-150 |
| Downstream | Ransomware ops |
| Aliases | CastleBot |
| Architecture | Stager → PE Loader → Core backdoor |
| Delivery vectors | ClickFix · fake GitHub · SEO-poisoned download portals · fake login/document pages |
| Hash algorithms | DJB2 (stager/loader) · AP-hash variant (core) |
| C2 protocol | HTTP, ChaCha20-encrypted serialized containers |
| Primary targets | Windows endpoints; US gov, IT, logistics, critical infra |
| Related malware | CastleRAT / PyNightshade, CastleStealer, Dave crypter, Hijack Loader |

## Operational attack chain · ClickFix-to-CastleLoader

1. **Lure surface** (Start)  
   SEO poisoning · fake GitHub · ClickFix page

2. **Stage 1 — Clipboard payload**  
   JS writes cmd to clipboard

3. **Stage 2 — User execution**  
   Win+R → paste → Enter  
   `finger.exe` / `curl` retrieves stage

4. **Stage 3 — Shellcode stager**  
   DJB2 hash · PEB walk · XOR decrypt  
   AutoIt · pythonw · Dave

5. **Stage 4 — PE Loader maps core**  
   `NtAllocateVirtualMemory` · PEB_LDR splice

6. **Stage 5 — Core backdoor · C2 tasking**  
   ChaCha20 · per-build UA token

7. **Impact — Payload deployment**  
   → stealers · RATs · ransomware precursors

ClickFix is the dominant delivery path. Trojanized installer downloads via SEO poisoning skip Stages 1—2 and enter at Stage 3 directly.

## Tactics, techniques, and procedures

CastleLoader maps to multiple MITRE ATT&CK Enterprise tactics. The highest technique density sits in Execution and Defense Evasion, consistent with a framework designed to defeat signature-based scanning and behavioral pattern matching simultaneously. The coverage map below combines public CastleBot mappings, campaign observations, and the BackgroundFix variant disclosed in April 2026.

### MITRE ATT&CK coverage

- Recon: 0  
- Resource Development: 1  
- Initial Access: 2  
- Execution: 9  
- Persistence: 1  
- Privilege Escalation: 0  
- Defense Evasion: 7  
- Credential Access: 0  
- Discovery: 3  
- Lateral Movement: 0  
- Collection: 0  
- Command and Control: 3  
- Exfiltration: 0  
- Impact: 0  

### Technique detail

| Tactic | Techniques | What CastleLoader does |
|---|---|---|
| Resource Development | [SEO Poisoning T1608.006](https://attack.mitre.org/techniques/T1608/006/) | Attackers use search-optimized fake download portals, fake GitHub repositories, and lookalike web pages to stage CastleLoader delivery before user execution. |
| Initial Access | [Spearphishing Link T1566.002](https://attack.mitre.org/techniques/T1566/002/) · [Drive-by Compromise T1189](https://attack.mitre.org/techniques/T1189/) | Cloudflare-themed ClickFix pages, fake GitHub repositories, and fake background-removal sites tracked as BackgroundFix. |
| Execution | [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/) · [cmd.exe T1059.003](https://attack.mitre.org/techniques/T1059/003/) · [Python T1059.006](https://attack.mitre.org/techniques/T1059/006/) · [AutoIT T1059.010](https://attack.mitre.org/techniques/T1059/010/) · [Malicious Copy and Paste T1204.004](https://attack.mitre.org/techniques/T1204/004/) · [Ingress Tool Transfer T1105](https://attack.mitre.org/techniques/T1105/) · [Regsvr32 T1218.010](https://attack.mitre.org/techniques/T1218/010/) · [Msiexec T1218.007](https://attack.mitre.org/techniques/T1218/007/) · [Native API T1106](https://attack.mitre.org/techniques/T1106/) | Victims paste `cmd` or `powershell` commands; variants invoke `finger.exe`, `pythonw.exe`, AutoIt, DLL execution via `regsvr32.exe`, MSI via `msiexec.exe`, and Native API-backed execution. |
| Persistence | [Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Uses `ITaskService` COM to register a scheduled task with `TASK_TRIGGER_LOGON`, configurable per task. |
| Defense Evasion | [APC Injection T1055.004](https://attack.mitre.org/techniques/T1055/004/) · [Process Hollowing T1055.012](https://attack.mitre.org/techniques/T1055/012/) · [Reflective Code Loading T1620](https://attack.mitre.org/techniques/T1620/) · [Dynamic API Resolution T1027.007](https://attack.mitre.org/techniques/T1027/007/) · [System Checks T1497.001](https://attack.mitre.org/techniques/T1497/001/) · [DLL Side-Loading T1574.002](https://attack.mitre.org/techniques/T1574/002/) · [Disable/Modify Tools T1562.001](https://attack.mitre.org/techniques/T1562/001/) | PEB_LDR_DATA splicing, DJB2 hashing, anti-VM checks, Windows 11 24H2 `NtManageHotPatch` bypass, reflective loading. |
| Discovery | [System Information T1082](https://attack.mitre.org/techniques/T1082/) · [System Owner/User T1033](https://attack.mitre.org/techniques/T1033/) · [System Time T1124](https://attack.mitre.org/techniques/T1124/) | Enumerates username, NetBIOS name, architecture, Windows version, DNS domain, and computes victim ID from volume serial. |
| Command and Control | [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/) · [Symmetric Cryptography T1573.001](https://attack.mitre.org/techniques/T1573/001/) · [Data Encoding T1132](https://attack.mitre.org/techniques/T1132/) | HTTP to hardcoded base URL; `/service/settings/<campaign_id>` initial GET; ChaCha20-encrypted tasking; per-build random User-Agent. |

## Indicators of compromise

The indicators below are durable behavioral and structural patterns that have remained consistent across CastleLoader campaigns.

### File paths and artifacts

- `C:\ProgramData\<instance_id>` — Hidden reinfection-prevention marker (`prevent_restart` flag)  
- `%ProgramData%\CeoliauD\Dabkina` — NetSupport drop path (BackgroundFix campaign)  
- `%APPDATA%\Roaming\<random>.exe` — Renamed python.exe (BYOI)  
- `%APPDATA%\*.au3 + AutoIt3.exe` — AutoIt delivery route  
- `%TEMP%\*.zip (GUID-named)` — PowerShell ClickFix ZIP container  
- `%TEMP%\python.zip.pdf` — Embedded Python download (BackgroundFix variant)

### Process tree patterns

- `explorer.exe → cmd.exe → finger.exe`  
- `explorer.exe → powershell.exe → Expand-Archive → AutoIt3.exe`  
- `cmd / finger → curl.exe → tar.exe → pythonw.exe`  
- `[trojanized installer].exe → [signed binary] → [tampered DLL]`  
- `pythonw.exe → outbound HTTP GET /service/settings/...`

### Network behavior

- Outbound TCP port 79 (finger) from endpoint  
- URI: `/service/settings/<hex_campaign_id>`  
- URI: `/service/download/<name>` (e.g. `data_3x.bin`)  
- URI: `/service/tasks` (POST) and `/service/tasks/complete/id/N`  
- User-Agent: random alphanumeric token (~20–32 chars)  
- User-Agent: `Googlebot` from non-server processes  

### Memory and behavioral artifacts

- PEB walk from user-process shellcode  
- PEB_LDR_DATA list write from user process  
- In-memory patch of `ntdll!NtManageHotPatch`  
- `ReplaceTextW` invocation with `FR_ENABLEHOOK`  

### BackgroundFix campaign domains

- `ai-scan[.]digital`  
- `bg-transparency[.]online`  
- `bg-go[.]online`  
- `background-off[.]com`  
- `bg-ready[.]online`  
- `bg-removerok[.]online`  
- `background-ready[.]online`  
- `backgroundformat[.]online`  

## Detection guidance

CastleLoader is engineered to defeat signature-based scanning: payloads are encrypted in transit, decrypted only in memory, and never written to disk as executables. Behavioral detection works because the chain combines clipboard activity, niche LOLBin usage, PEB-level manipulation, and a distinctively shaped HTTP check-in sequence.

1. **Clipboard-to-process correlation**  
   Detect clipboard contents containing `cmd.exe /k`, `finger`, `powershell`, `Invoke-WebRequest`, `for /f "skip=`, or `pythonw`, followed within 30 seconds by execution of those binaries with `explorer.exe` as parent.

2. **finger.exe execution from a user-shell context**  
   Alert on `finger.exe <user>@<domain>` spawned by `cmd.exe` or `explorer.exe`. Monitor outbound TCP/79.

3. **Bring-your-own-interpreter Python from user-writable paths**  
   Alert on `pythonw.exe` or `python.exe` running from `%APPDATA%`, `%LOCALAPPDATA%`, or `%TEMP%`, especially after `tar.exe` extraction.

4. **PEB_LDR_DATA module-list manipulation**  
   Detect userland writes to `InLoadOrderModuleList` / `InMemoryOrderModuleList` not originating from `ntdll!LdrLoadDll`.

5. **In-memory patching of NtManageHotPatch**  
   Monitor writes to the `NtManageHotPatch` export in `ntdll.dll`, particularly on Windows 11 24H2+ systems.

6. **HTTP traffic with `/service/settings/` or `/service/tasks` URIs**  
   Flag outbound HTTP requests matching `/service/settings/<hex>`, `/service/tasks`, `/service/download/<name>`, or `/service/tasks/complete/id/<N>`.

7. **Unusual User-Agent patterns from user processes**  
   Detect `Googlebot` or high-entropy 20–32 character alphanumeric User-Agents from workstation endpoints.

## Hardening recommendations

The following controls block dominant CastleLoader delivery chains without additional product purchases.

1. **Disable the Windows Run dialog for non-admin users** (Quick win)  
   Set `NoRun` Group Policy for user-tier accounts.  
   Registry: `HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun` = 1.

2. **Block outbound TCP port 79 (finger) at network egress** (Quick win)  
   Deny TCP/79 from endpoint subnets. Optionally block `finger.exe` via AppLocker.

3. **Block execution from user-writable paths via AppLocker or WDAC** (Standard)  
   Deny unsigned execution from `%APPDATA%`, `%LOCALAPPDATA%`, `%TEMP%`. Roll out in audit mode first.

4. **Enable PowerShell script-block logging and Constrained Language Mode** (Quick win)  
   Enable via Group Policy:  
   Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging.

5. **Constrain LOLBin execution: regsvr32, msiexec, MSBuild, InstallUtil, RegSvcs** (Standard)  
   Use AppLocker executable rules with audit-mode rollout, then enforce denies for non-admin contexts.

Controls 1–2 block the most prevalent BackgroundFix delivery chain. Control 3 blocks the stager stage across variants. Controls 4–5 limit task-execution flexibility. User awareness training against “press Win+R and paste this” prompts remains a critical complementary defense.

## Primary references

- [MITRE ATT&CK — Enterprise framework](https://attack.mitre.org/) (2025)  
- [Microsoft Win32 API documentation](https://learn.microsoft.com/en-us/windows/win32/api/) (2025)  
- [Microsoft Security documentation](https://learn.microsoft.com/en-us/windows/security/) (2025)