GrayBravo MaaS Deploys CastleRAT Backdoor, Hiding C2 with Steam Profile Dead Drop Resolvers

According to Insikt Group (Recorded Future), GrayBravo MaaS is powering a tiered threat ecosystem that includes CastleLoader and the newly discovered CastleRAT, a remote access trojan capable of stealing credentials, logging keystrokes and capturing screens.

CastleRAT employs Dead Drop Resolvers to conceal its command-and-control servers by checking public Steam Community profiles for encoded instructions, such as steamcommunity[.]com/id/autryjones, allowing attackers to update infrastructure without redeploying malware.

The analysis identifies four activity clusters, with Cluster 1 (TAG-160) targeting logistics and impersonating firms like England Logistics, using a “dpeforms” lure and ClickFix techniques to deliver CastleLoader by compromising platforms such as DAT Freight & Analytics and Loadlink. A second cluster, TAG-161, targets the hospitality sector with Phishing Email Management Tooling panels to automate mass phishing campaigns at Booking[.]com users.

Researchers also connect the infrastructure to a user known as “Sparja” on Exploit Forum, noting past activity around custom droppers that aligns with CastleLoader’s development timeline. The findings appear in a December 10, 2025 report on the evolving CastleRAT/MaaS ecosystem.