Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

Four distinct threat activity clusters have been observed using CastleLoader, bolstering the view that the loader is offered as a malware-as-a-service (MaaS) tool. According to Recorded Future’s Insikt Group, the threat actor behind CastleLoader has been named GrayBravo, previously tracked as TAG-150, and Mastercard-owned Recorded Future states that GrayBravo is characterised by rapid development cycles, technical sophistication, responsiveness to public reporting, and an expansive, evolving infrastructure.

The four clusters include Cluster 1 (TAG-160) targeting the logistics sector with phishing and ClickFix to distribute CastleLoader (active since at least March 2025); Cluster 2 (TAG-161) using Booking[.]com-themed ClickFix campaigns to push CastleLoader and Matanbuchus 3.0 (active since at least June 2025); Cluster 3 delivering CastleRAT via CastleLoader using Booking[.]com

impersonation and Steam Community pages (active since at least March 2025); and Cluster 4 employing malvertising and fake software update lures masquerading as Zabbix and RVTools to distribute CastleLoader and NetSupport RAT (active since at least April 2025). Recorded Future notes GrayBravo’s multi-tiered infrastructure, including Tier 1 C2 servers tied to CastleLoader, CastleRAT, SectopRAT, and WARMCOOKIE, plus multiple VPS backups to support operations.