CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

TAG-150 is a Malware-as-a-Service (MaaS) operator active since March 2025, utilizing two malware families: CastleLoader and CastleRAT. CastleLoader serves as a loader to download additional malware, while CastleRAT is a remote access trojan that allows attackers to control compromised systems. Darktrace detected and blocked early attack activities linked to TAG-150, employing its Autonomous Response capabilities to prevent further compromise.

CastleLoader uses deceptive tactics, such as fake domains and GitHub repositories, to trick users into executing malware. The malware's modular architecture enhances its effectiveness by separating the initial infection from payload deployment. Darktrace's monitoring identified unusual connections and behaviors associated with CastleLoader, leading to proactive containment of the threat.

The rise of MaaS and modular toolkits poses challenges for security teams, but Darktrace's AI-driven detection and response capabilities demonstrate effectiveness in countering these evolving threats.