Insikt Group identifies a new threat actor, TAG-150, active since at least March 2025. Its multi-layered infrastructure is used to deploy likely self-developed malware families, including CastleLoader, CastleBot, and the newly documented CastleRAT. www.recordedfuture.com/research/fro...

IBM X-Force's Golo Mühr looks into a newly emerging malware MaaS framework named CastleBot. Follow-on payloads range from infostealers to backdoors linked to ransomware attacks, such as NetSupport and WarmCookie. www.ibm.com/think/x-forc...

🔎 CastleBot: modular MaaS empowering infostealer-to-Ransomware attacks

IBM X‑Force reveals CastleBot, a new MaaS platform that deploys everything from infostealers to backdoors like NetSupport and WarmCookie, all delivered via fake installers, GitHub impersonation, and ClickFix.

#ransomNews

CastleBot Malware-as-a-Service Deploys Range of Payloads Linked to Ransomware Attacks

2/ TAG-150 is Insikt Group’s designation for the actor likely behind the malware families #CastleLoader, #CastleBot, and most recently #CastleRAT, a RAT documented here for the first time.

Dissecting the CastleBot Malware-as-a-Service operation | IBM www.ibm.com/think/x-forc...

CastleBot Malware-as-a-Service Deploys Range of Payloads Linked to Ransomware Attacks A sophisticated new malware framework named CastleBot has emerged as a significant threat to cybersecurity, ope...

#cyberf="/hashtag/Cyber" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link">#Cyber #security/hashtag/Security" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link">#Security #newsef="/hashtag/News" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link">#News #Threats #cyber #security #cyber #security #news

Origin | Interest | Match

Dissecting the CastleBot Malware-as-a-Service operation