From CastleLoader to CastleRAT: TAG-150’s Multi-Tiered Cyber Arsenal Expands

Security researchers have documented a major advance in the operations of the newly designated TAG-150 threat actor, expanding its multi-tiered cyber arsenal with CastleRAT alongside CastleLoader and CastleBot. According to Insikt Group, TAG-150 has been active since at least March 2025, exhibiting rapid development, technical sophistication, responsiveness to public reporting, and a large, evolving infrastructure.

The debut of CastleRAT, available in Python and C variants, adds capabilities for system information collection, downloading and executing payloads, and issuing commands via CMD and PowerShell, with Python using Steam Community pages as C2 dead drops.

The group describes a four-tier infrastructure model, from victim-facing Tier 1 servers to Tier 4 backup nodes maintaining persistent high-port UDP connections, including an instance where a Tier 4 server interacted with a CastleLoader panel deemed an operational security lapse. Two CastleRAT variants were observed: a lightweight Python variant and a more capable C variant featuring keylogging and screen capture, with the latter also checking for VPN or proxy indicators via ip-api[.]com.

The report notes potential overlap between TAG-150 infrastructure and Play Ransomware operations, and highlights use of anonymising services such as temp[.]sh and Lokinet for secure messaging.