TAG-150
Tracked by CyberSIXT since 5 Sep 2025
- Articlesall time
- 8
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
8 articles from 4 outlets since 5 Sep 2025; the latest 94 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 24 Jul · 10:00 UTC | SecurityOnline | Financial Firm Hit by ClickFix, DenoRAT and NightshadeC2 |
| Wed 10 Dec 2025 · 01:15 UTC | SecurityOnline | GrayBravo MaaS Deploys CastleRAT Backdoor, Hiding C2 with Steam Profile Dead Drop Resolvers |
| Tue 9 Dec 2025 · 17:15 UTC | The Hacker News | Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure |
| Mon 1 Dec 2025 · 01:41 UTC | SecurityOnline | New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US Devices |
| Tue 9 Sep 2025 · 00:40 UTC | SecurityOnline | From CastleLoader to CastleRAT: TAG-150’s Multi-Tiered Cyber Arsenal Expands |
| Fri 5 Sep 2025 · 20:46 UTC | Dark Reading | Secretive MaaS Group 'TAG-150' Develops Novel 'CastleRAT' |
| Fri 5 Sep 2025 · 15:16 UTC | The Hacker News | TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations |
| Fri 5 Sep 2025 · 12:58 UTC | GBHackers | TAG-150 Hackers Escalate Attacks with Proprietary Malware Families |
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Malpedia and MISP Galaxy list GrayBravo as an alias for TAG-1502,3. The Hacker News identified TAG-150 as the actor behind the MaaS framework CastleLoader1.
The Hacker News reported that TAG-150 developed CastleRAT in Python and C variants, with the Python variant also called PyNightshade1. It reported that CastleLoader had been active since at least March 2025, with infections commonly initiated through Cloudflare-themed phishing and fraudulent GitHub repositories1. The Hacker News described CastleRAT using Steam Community profiles as dead drop resolvers and said the C variant added keystroke logging, screenshots and cryptocurrency clipping1.
Sources
- TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations · The Hacker News · 2025-09-05
- TAG-150: alias · Malpedia
- TAG-150: alias · MISP Galaxy
Names and sources
- GrayBravo
- CyberSIXT coverage, Malpedia, MISP Galaxy
- TAG-150
- Malpedia, MISP Galaxy
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for TAG-150.
- Financial Firm Hit by ClickFix, DenoRAT and NightshadeC2SecurityOnline
- GrayBravo MaaS Deploys CastleRAT Backdoor, Hiding C2 with Steam Profile Dead Drop ResolversSecurityOnline
- Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service InfrastructureThe Hacker News
- New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US DevicesSecurityOnline
- From CastleLoader to CastleRAT: TAG-150’s Multi-Tiered Cyber Arsenal ExpandsSecurityOnline
- Secretive MaaS Group 'TAG-150' Develops Novel 'CastleRAT'Dark Reading
- TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware OperationsThe Hacker News
- TAG-150 Hackers Escalate Attacks with Proprietary Malware FamiliesGBHackers · first in our coverage