TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations

According to The Hacker News, TAG-150—the threat actor behind the MaaS framework CastleLoader—has developed a new remote access trojan named CastleRAT, available in both Python and C variants. The core capabilities include collecting system information, downloading and executing additional payloads, and issuing commands via CMD and PowerShell, with the Python variant also called PyNightshade.

Evidence indicates CastleLoader has been active since at least March 2025, using a multi-tiered infrastructure with Tier 1 victim-facing C2 servers and multiple VPS-based tiers. CastleRAT can download next-stage payloads, enable remote shell access, and even delete itself, and it uses Steam Community profiles as dead drop resolvers for hosting C2 servers.

The C variant adds keystroke logging, screenshots, file upload/download, and cryptocurrency clipping features, while both versions query ip-api[.]com for geolocation based on the infected host’s IP address. Infections are commonly initiated via Cloudflare-themed phishing and fraudulent GitHub repositories, with C2 panels hosted across Latvia, the United Kingdom, and the Netherlands.