Secretive MaaS Group 'TAG-150' Develops Novel 'CastleRAT'

A young malware-as-a-service (MaaS) operation known as TAG-150 has rolled out a new remote access trojan family called CastleRAT, with variants in C and Python, after linking CastleLoader and CastleBot in its ecosystem. Researchers traced CastleLoader back to March, and by midsummer it appeared in more than 1,600 attacks, with about 470 infections succeeding, a 28.7% success rate.

The operation has infected more than 400 victims deemed “critical,” including a notable number of United States government agencies, and most victim IPs are located in the United States. CastleRAT’s C version includes features such as a clipper, keylogger and screen capturer, plus geolocation down to city and ZIP code, though later versions have pared this back, while the Python variant—also known as PyNightshade—emphasises stealth and excludes some of the heavier capabilities.

CastleRAT employs Steam as a C2 dead drops channel and has been distributed via boobytrapped GitHub repositories and other methods; according to Insikt Group, this strongly suggests a MaaS model with potential for expansion or higher premiums. The researchers note that TAG-150 maintains a limited Dark Web presence, a factor that may reflect a more sophisticated customer base, according to Jerrilee Plude, senior threat intelligence analyst with Recorded Future.