Sophisticated CastleRAT Backdoor Uses Steam Community Pages as Covert C2 Resolver for Espionage

A new Remote Access Trojan named CastleRAT has emerged, with the Splunk Threat Research Team (STRT) identifying it around March 2025 and noting that two variants exist—Python and C—with the C-compiled version deemed the more dangerous due to its stealth and expanded capabilities. According to Splunk STRT, the C build tends to be stealthier and may include features such as keystroke capture, screen grabs, and more persistent installation methods.

CastleRAT communicates with its C2 server using a simple RC4 algorithm with a hardcoded key to mask traffic from basic network monitoring tools. The infection typically begins with reconnaissance data being gathered from a compromised host, including computer name, username, machine GUID, Product name, and the malware queries a public web service to obtain the host’s public IP, beaconing this back to the attacker.

To hide its C2 infrastructure, CastleRAT uses Steam Community pages as benign-looking dead-drop resolvers, where encoded instructions are posted for retrieval by the malware.