A sophisticated malware loader designated CastleLoader has emerged as a significant threat to U.S. government agencies and critical infrastructure sectors, according to extensive malware analysis.
The loader has impacted approximately 469 devices across multiple industries, with particular focus on government entities.
CastleLoader functions as an initial access threat, deploying advanced evasion techniques that circumvent traditional detection mechanisms.
The malware operates through a multi-stage execution chain, beginning with an Inno Setup installer that extracts AutoIt scripts, which subsequently performs process hollowing by injecting malicious payloads into legitimate system processes like jsc.exe (JScript.NET compiler).
The loader’s delivery commonly occurs through ClickFix social engineering campaigns, where victims are deceived into executing malicious commands via fake verification prompts.
Once executed, CastleLoader serves as the second-stage loader, deploying follow-on payloads directly into memory to evade file-based detection systems. This approach makes traditional signature-based and behavioral detection largely ineffective.
According to Any.run, Technical analysis reveals that CastleLoader relies on sophisticated obfuscation, with heavily encrypted configuration data embedded within the binary.
The malware utilizes a custom XOR decryption algorithm with cyclic key masking to decode critical infrastructure parameters.
Researchers successfully extracted the command and control infrastructure, identifying the C2 server at 94.159.113.32, along with distinctive indicators of compromise including mutex names and user agent strings.
The loader’s primary objective involves delivering information stealers and remote access trojans (RATs) to compromised systems, enabling credential theft and persistent network access.
Its infection rate and universal compatibility have made it an attractive tool for adversaries targeting sensitive government networks and logistics, travel, and European critical infrastructure sectors.
Detection and prevention require modern threat intelligence reflecting real-world attack data. Organizations should implement comprehensive endpoint detection and response solutions capable of monitoring process memory injections and suspicious inter-process communications.
Additionally, integrating real-time threat intelligence feeds powered by live sandbox analyses can accelerate threat identification and response, reducing mean time to detection and response metrics significantly.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
