Skip to content

CyberSIXT Search

Threat actor · coverage timeline

TAG-150

8 articles from 4 outlets between 5 Sep 2025 and 24 Jul. First reported by GBHackers. The busiest day was Fri 5 Sep 2025, with 3 articles.

Articles: 8; all time · from 4 outlets
Days with coverage: 6; across 323 days
Busiest day: 3; articles on Fri 5 Sep 2025
Last 7 days: 0a day; vs 0 a day before
First report: 5 Sep 2025; GBHackers
CVEs named: 0; in these articles

Coverage over time

8 articles · 5 Sep 2025 – 24 Jul

5 Sep 2025First report5 Sep 2025 · GBHackers

Show as table

TAG-150: articles per day
Day (UTC)	Articles	Outlets
Fri 5 Sep 2025	3	GBHackers 1, The Hacker News 1, Dark Reading 1
Tue 9 Sep 2025	1	SecurityOnline 1
Mon 1 Dec 2025	1	SecurityOnline 1
Tue 9 Dec 2025	1	The Hacker News 1
Wed 10 Dec 2025	1	SecurityOnline 1
Fri 24 Jul	1	SecurityOnline 1

Articles

8 articles

Fri 24 Jul1 article

10:00
Financial Firm Hit by ClickFix, DenoRAT and NightshadeC2SecurityOnline

Wed 10 Dec 2025 20251 article

01:15
GrayBravo MaaS Deploys CastleRAT Backdoor, Hiding C2 with Steam Profile Dead Drop ResolversSecurityOnline

Tue 9 Dec 2025 20251 article

17:15
Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service InfrastructureThe Hacker News

Mon 1 Dec 2025 20251 article

01:41
New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US DevicesSecurityOnline

Tue 9 Sep 2025 20251 article

00:40
From CastleLoader to CastleRAT: TAG-150’s Multi-Tiered Cyber Arsenal ExpandsSecurityOnline

Fri 5 Sep 2025 20253 articles

20:46
Secretive MaaS Group 'TAG-150' Develops Novel 'CastleRAT'Dark Reading
15:16
TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware OperationsThe Hacker News
12:58
TAG-150 Hackers Escalate Attacks with Proprietary Malware FamiliesGBHackers · first report