Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

What is CastleLoader?

Previously documented components include CastleStealer (net40), a .NET infostealer; PythonRAT, a Python-based remote access tool via ClickFix-style lures; and NetSupport RAT, providing persistent remote access across all observed campaigns. What has not been reported until now is the introduction of NeedleStealer into this same delivery chain.

Urutyka Campaign

A PowerShell stager was uploaded to VirusTotal on June 18, 2026. An obfuscated PowerShell stager unpacks a second PS1 script, contacts a download server to drop traffic1.ms1. The downloaded MSI executes a .bat file launching embedded IronPython, which downloads another Python script responsible for injecting CastleLoader's stage 2 shellcode. Stage 2 shellcode retrieves the stage 3 CastleLoader payload in memory. CastleLoader queries its C2 via a get_tasks command. Tasks return encrypted payloads: NetSupport RAT and Lobshot.

Each payload from a specific tasking has a unique RC4 key. By replicating get_tasks using extracted keys, researchers decrypted HTTP responses and confirmed payload manifests without executing malware. RetroHunt results surfaced only three related samples over the past year, indicating this tooling is tightly controlled and not broadly distributed.

Garrigin Campaign

Shares structural similarities with Urutyka but introduces a Nullsoft Scriptable Install System (NSIS) dropper for the IronPython runtime and a C/C++ injector for CastleStealer. The initial PowerShell stager downloads traffic1.exe, spoofing a Microsoft Edge update, dropped to %ProgramData%\EdgeUpdate\. Notable behaviors include forcing TLS 1.2, stripping Zone.Identifier ADS (Mark-of-the-Web) to evade SmartScreen, and deleting the RunMRU registry key to cover tracks.

Noidret Campaign

Described as the most technically significant of the three, delivering the prior payload suite (NetSupport RAT plus CastleStealer) while introducing two first-observed NeedleStealer payloads distributed through a NodeJS-based shellcode injector. Notably, the final two payloads share the same RC4 key — a notable deviation that may indicate they were packaged together.

NeedleStealer: Desktop Wallet Spoofer (Rust)

This Rust-based payload is a GUI-driven cryptocurrency wallet spoofer. Delivered as a ZIP archive extracted to ProgramData\\NodeJS, alongside a legitimate Node.js binary and two AES-GCM encrypted files. Supported wallet targets include Ledger, Trezor, and Exodus as the most polished implementations, with others present as partially developed landing pages. When executed against a target such as Ledger, the GUI renders a convincing recovery seed prompt designed to harvest the victim's seed phrase.

NeedleStealer: Browser Spoofer (Golang)

Once injected, it installs malicious browser extensions while also planting extensions that appear legitimate to avoid detection. The fake extension poses as an ad blocker. The extension grants persistent access to browser sessions, enabling session token theft and credential harvesting.

Both NeedleStealer payloads share the C2 domain kileant[.]com, which remained undetected and "clean" on VirusTotal at the time of this analysis.

Recommendations

• Harden against ClickFix and spoofed installer lures; enforce application allowlisting from %ProgramData% and user-writable directories.
• Block known infrastructure via DNS blocklists and firewall rules.
• Validate code-signing certificates; add Mahu Agro and TECHNOLOGY APPRAISALS LIMITED to blocklists.
• Enable PowerShell Script Block Logging (Event IDs 4103/4104); alert on IronPython execution from suspicious paths.
• Alert on node.exe executing from %ProgramData% or non-standard directories; consider blocking Node.js in non-development environments.

IOCs and MITRE ATT&CK mapping are available at the Arctic Wolf public GitHub repository.