CastleBot Malware-as-a-Service – Unleashing a Variety of Payloads Behind Ransomware Strikes

IBM X-Force researchers have uncovered a sophisticated new malware framework called CastleBot that emerged in early 2025, operating as a Malware-as-a-Service (MaaS) platform designed to deliver diverse malicious payloads ranging from infostealers to backdoors linked to ransomware operations.

The framework has demonstrated alarming flexibility in payload deployment, with researchers observing a significant increase in samples and attack diversity beginning in May 2025.

Three-Stage Attack Architecture

CastleBot employs a sophisticated three-component architecture comprising a stager, loader, and core backdoor module.

The lightweight shellcode stager uses the DJB2 hashing algorithm to resolve APIs at runtime and downloads two encrypted payloads via HTTP using the “Googlebot” User Agent.

These payloads are decrypted using hardcoded XOR strings, revealing the core CastleBot backdoor and a specialized loader component.

The CastleBot Loader functions as a fully-featured PE loader that maps sections into memory, fixes relocations, and notably creates LDR_DATA_TABLE_ENTRY structures to make injected payloads appear legitimately loaded to EDR agents monitoring the Process Environment Block.

The core backdoor utilizes the AP hash algorithm for API resolution and establishes encrypted communication with command-and-control servers using the ChaCha symmetric encryption algorithm.

Recent July 2025 updates have expanded CastleBot’s capabilities with nine different launch methods, including support for MSI files and an improved process injection mechanism using QueueUserAPC and the CastleBot Loader component.

The malware can bypass Windows 11 24H2 memory protections by hooking NTDLL’s NtManageHotPatch function.

Distribution and Payload Diversity

CastleBot’s primary infection vector involves trojanized software installers distributed through fake websites leveraging SEO poisoning techniques.

The framework has also been observed using GitHub repositories and the ClickFix technique to lure victims.

Security researchers have documented campaigns impersonating legitimate software, including DocuSign, SSMS, Zscaler, and GlobalProtect.

The malware’s payload diversity is particularly concerning, with documented deployments of NetSupport and WarmCookie backdoors both previously linked to ransomware operations.

Additional payloads include various infostealers such as Rhadamanthys, Remcos, DeerStealer, SecTopRAT, HijackLoader, and MonsterV2.

The framework’s ability to deploy multiple payloads simultaneously within single campaigns demonstrates its operators’ sophisticated victim targeting and payload management capabilities.

X-Force analysis suggests CastleBot operates as a private MaaS offering rather than a widely advertised service, indicating controlled distribution among select affiliate groups.

This selective approach, combined with the framework’s technical sophistication and active development, positions CastleBot as a significant emerging threat in the cybercriminal ecosystem.

Indicators of Compromise

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates