Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection
Arctic Wolf Labs has been tracking a cluster of campaigns built around CastleLoader, a multi-stage shellcode loader that has served as the backbone of a number of related intrusion sets over the past year. Previous reporting from Huntress documented the.NET-based CastleStealer (net40), and LevelBlue documented the PythonRAT observed in related campaigns. Both reports noted NetSupport RAT as a common final payload.