TAG-150 Hackers Escalate Attacks with Proprietary Malware Families

According to Recorded Future’s Insikt Group, TAG-150 is a sophisticated threat actor active since at least March 2025, known for rapid malware development and a sprawling four-tier infrastructure. The group has deployed self-developed families including CastleLoader, CastleBot, and most recently CastleRAT, targeting organisations via phishing campaigns and fraudulent repositories.

Infection vectors centre on Cloudflare-themed “ClickFix” phishing attacks and bogus GitHub repositories used to deliver PowerShell commands, with a reported infection rate of nearly 29% among engaged users. The four-tier model features C2 servers for multiple loaders, VPS midpoints, and clusters including a Russian residential IP, with infrastructure hosted across networks and registered via providers such as NameCheap or TUCOWS.

MITIGATIONS urged include blocking CastleLoader and related loaders, monitoring file-sharing services, and deploying YARA, Snort, and Sigma rules, alongside robust email filtering and anomaly detection for data exfiltration. Insikt Group anticipates further stealth and evasion enhancements and notes potential Malware-as-a-Service options enabling third-party affiliates to deploy TAG-150 tools.