Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

Summary

Arctic Wolf Labs has been tracking a cluster of campaigns built around CastleLoader, a multi-stage shellcode loader that has served as the backbone of a number of related intrusion sets over the past year. Previous reporting from Huntress documented the .NET-based CastleStealer (net40), and LevelBlue documented the PythonRAT observed in related campaigns. Both reports noted NetSupport RAT as a common final payload.

What we are documenting now goes further. Through active C2 querying, YARA-based retrohunting, and sandbox detonation, we have identified some distinct updates to the infection chain through several different campaigns. Most notably, the Noidret infection-chain now distributes two payloads tied to the NeedleStealer framework: a Rust-based desktop wallet spoofer, and a Golang-based malicious browser extension installer. These represent the first observed use of Rust and Golang tooling within this campaign cluster.

We have also identified a new shellcode loader variant spreading via digitally signed installers, and several staged domains that appear positioned for future operations. In this report we’ll outline our findings, examine how NeedleStealer fits into the bigger picture, and provide defensive mitigations defenders can use to protect their organizations against this type of threat.

What is CastleLoader?

Huntress and LevelBlue have previously documented the foundational components of this campaign cluster:

• CastleStealer (net40): A .NET infostealer documented by Huntress in their BackgroundFix/CastleLoader report.
• PythonRAT: A Python-based remote access tool documented by LevelBlue, distributed via ClickFix-style lures.
• NetSupport RAT: Consistently deployed as a persistent remote access capability across all observed campaigns.

CastleLoader is delivered via a consistent infection chain, with follow-on payloads varying by campaign. What has not been reported until now is the introduction of NeedleStealer into this same delivery chain. NeedleStealer is a framework with dedicated Rust and Golang components targeting cryptocurrency wallets and browsers.

Investigating CastleLoader’s Campaigns

Urutyka Campaign

A PowerShell stager was uploaded to VirusTotal on June 18, 2026. The Urutyka campaign follows CastleLoader’s established infection chain and delivery methods, with one notable addition: a VNC-based remote viewer, most likely a variant of Lobshot.

Infection Chain:

1. The obfuscated PowerShell stager unpacks a second PS1 script and contacts the download server at pub-6728b11f74fd435f926ed25c5f2952bb[.]r2[.]dev to drop the traffic1.ms1 file.

Figure 1: Initial PowerShell stager (Click to enlarge).

Figure 2: Final PowerShell stage / downloader

2. The downloaded MSI file executes a .bat file that launches a embedded IronPython installation that follows a similar infection chain to previous CastleLoader intrusions. The python3 script downloads another python script from the C2 server that is responsible for injecting CastleLoader’s stage 2 shellcode.

Figure 3: Malicious .bat and encoded python stager

Figure 4: Base64 decoded python downloader

Figure 5: Stage 2 python injector

3. Stage 2 shellcode reaches back for the final stage 3 CastleLoader payload, all within memory.
4. CastleLoader queries its C2 via a get_tasks command.
5. Tasks return encrypted payloads: NetSupport RAT and Lobshot.

Each payload from a specific tasking has a unique RC4 key. By replicating the get_tasks request using keys extracted from the CastleLoader binary, we were able to decrypt the HTTP response and confirm the payload manifest and downstream C2s without executing the malware.

Infrastructure:

RetroHunt Results: YARA coverage against VirusTotal surfaced only three related samples over the past year, indicating this tooling is tightly controlled and not broadly distributed:

• 0c48fd6a18ad9c701b254bbdd412efbf7dfdd2be6534a61c14bce719d259df9f – 0 detections, June 2026
• fa67487da701ce1d61ee3abb84869f669a6c2aa50ca0148a3c4a87e667716638 – May 2026
• 2fcf553b9656523b3207c08cdf16f7be9a25e55cf8c29f5caf933151c9214367 – March 2026

Garrigin Campaign

This campaign shares structural similarities with Urutyka, but introduces two new elements: a Nullsoft Scriptable Install System (NSIS) dropper for the IronPython runtime, and a C/C++ injector for CastleStealer.

Infection Chain:

1. An obfuscated PowerShell stager (similar to Urutyka but with distinct obfuscation) downloads and executes traffic1.exe, spoofing a Microsoft Edge update.

Figure 6: Initial PowerShell stager

Infrastructure:

• C2 / download URL: hxxps://pub-4d5f81bf79554aa7a2187e6ffbc9702a[.]r2[.]dev/traffic1[.]exe (Cloudflare R2 CDN)
• Callback URL: hxxp://94.26.90[.]112/dl-callback/6dkcdpd7-4jacbuf9-prutgux4-2ybssc8v/traffic1[.]exe/1390903f57b21f346193aefbbfd36759
• Drop path: %ProgramData%\EdgeUpdate\traffic1.exe (masquerades as a Windows EdgeUpdate directory)

Behavior:

• Forces TLS 1.2
• Creates %ProgramData%\EdgeUpdate\ (legitimate-looking staging dir)
• Strips Zone.Identifier ADS (Mark-of-the-Web) to evade SmartScreen
• Executes the dropped and hidden EXE
• Deletes RunMRU registry key to cover its tracks: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Figure 7: Final PowerShell downloader

2. The traffic1.exe is a Nullsoft installer that unpacks a Python runtime (ipyw32.exe) and an encoded script (antimony.txt) hidden under the system’s Policies folder.
3. The decoded Python script is a download cradle that pulls CastleLoader Stage 2 shellcode from grenagana[.]com (the document1 payload).
4. CastleLoader injects into memory and proceeds with the standard get_tasks.
5. NetSupport and CastleStealer get installed on the victim’s device.

CLR Injector / CastleStealer: We recovered a C/C++ injector that likely serves as a wrapper to deliver CastleStealer (net40). The C2 is 179.132.128[.]189.

Figure 8: CastleStealer’s new injector

The CastleStealer payload is stored in the .data segment of the loader and gets injected into memory. Extracting the final .NET assembly confirms this is a variant of CastleStealer.

Figure 9: Embedded PE

Figure 10: String decryption of CastleStealer old / new sample (Click to enlarge). 

Infrastructure:

Noidret Campaign

The Noidret campaign is the most technically significant of the three. It delivers the prior payload suite (NetSupport RAT plus CastleStealer) and introduces two first-observed NeedleStealer payloads distributed through a NodeJS-based shellcode injector.

Infection Chain:

1. Obfuscated .bat file invokes an IronPython shellcode injector.
2. The injector loads a small (~8 KB) x64 shellcode stub into memory.
3. The stub contacts the C2 and downloads the final CastleLoader payload.
4. CastleLoader issues get_tasks, which returns RC4-encrypted payloads from multiple download servers. Notably, the final two payloads share the same RC4 key.

Download Servers and Payloads:

Figure 11: Decrypted tasking from C2

NeedleStealer: Desktop Wallet Spoofer (Rust)

First documented by defensive security provider Beelzebub in their NeedleStealer C2 analysis, this Rust-based payload is a GUI-driven cryptocurrency wallet spoofer. It is delivered as a ZIP archive extracted to ProgramData\\NodeJS, alongside a legitimate Node.js binary and two AES-GCM encrypted files. A NodeJS injector script (which is likely AI-assisted in its original form before being run through an obfuscator) decrypts and loads an 8 KB shellcode stub, which then reflectively injects the Rust payload.

Figure 12: NodeJS injector for NeedleStealer

The binary accepts three required command-line arguments in a fixed order:

<wallet_spoofer>.exe –daemon –ui <WalletName>

Supported wallet targets include Ledger, Trezor, and Exodus as the most polished implementations, with others present as partially developed landing pages.

Figure 13: Waller Spoofer options

When executed against a target such as Ledger, the GUI renders a convincing recovery seed prompt designed to harvest the victim’s seed phrase.

Figure 14: Wallet Spoofer’s fake user interfaces (Click to enlarge).

NeedleStealer: Browser Spoofer (Golang)

The Golang payload is installed using the same method as the Rust implant, with a NodeJS injector and small shellcode stub. Once injected it installs malicious browser extensions while also planting extensions that appear legitimate to avoid detection. In this particular campaign, the fake extension poses as an ad blocker. This is a different lure than the one observed by MalwareBytes in their April 2026 reporting on NeedleStealer delivery. The extension grants persistent access to browser sessions, enabling session token theft and credential harvesting.

Figure 15: Main poll function

Figure 16: Icons inside fake extension

Figure 17: File/folder structure for fake extension

Both NeedleStealer payloads share the C2 domain kileant[.]com, which remained undetected and “clean” on VirusTotal at the time of this analysis.

Digitally Signed Installers

Following YARA rule development targeting shellcode loaders from both the Sedalia and Noidret campaigns, we identified a new shellcode loader variant on VirusTotal contacting qxvnrta[.]com. Pivoting on this indicator, we found multiple digitally signed installers pointing to the same infrastructure.

The C2 endpoint for the original v11 package now returns a 404. Based on VT behavioral analysis, the updated URI appears to be new_pkg1.

Reference sample: edff43ecdf7aa476331d925db04e68a2251920165a2109be9df91a56d86b87c7

Two code-signing certificates have been observed authenticating malicious installers within this cluster:

• Mahu Agro: VT search
• TECHNOLOGY APPRAISALS LIMITED: VT search

We also identified a malicious installer that beaconed out to qxvnrta[.]com; this domain was also found in a stage 2 CastleLoader shellcode stub linking the delivery to an installer with a valid code signing certificate.

Further investigation into related installers identified another interesting domain: kaneta[.]cc. Traffic to this domain has been minimal, suggesting it may have been staged for a future campaign or used for testing. The same server hosts monblare[.]com, which had zero VT detections and no traffic as of this writing. SSL certificates for both domains are valid through August 2026.

• d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be (signed)

Infrastructure Patterns and Pivoting

Across all three campaigns, several infrastructure patterns persist:

• Naming Convention: Campaign domains follow a consistent pattern of invented, phonetically unusual English-adjacent words (Urutyka, Garrigin, Noidret, Fangorinaf, Quiantar). This appears to be a deliberate choice to avoid typosquat detection and reduce brand-spoofing flags.
• Port Reuse: NetSupport C2s cluster around ports 4889 and 5500.
• Shared Loader Stub: The ~8 KB x64 shellcode stub appears across Urutyka, Garrigin, and Noidret (likely the same or closely related loader).
• RC4 Per Payload: Individual download server payloads use unique RC4 keys, with the NeedleStealer payloads sharing a key, a notable deviation that may indicate they were packaged together.

Domains of Interest: Staged or Emerging:

Why NeedleStealer? Assessing the Tactical Shift

CastleStealer and NetSupport RAT have been sufficient for this threat actor’s operations over the past year. The introduction of NeedleStealer’s Rust and Golang tooling raises a pointed question: What does NeedleStealer provide that the existing toolkit does not?

Several hypotheses include the following:

1. Cryptocurrency-specific targeting. CastleStealer is a general-purpose infostealer. The NeedleStealer wallet spoofer is purpose-built to harvest recovery seeds from hardware wallet users: a high-value, difficult-to-reverse target. This suggests the actor is expanding from broad credential theft toward high-yield crypto targets.
2. Browser persistence at depth. The Golang browser spoofer installs at the extension layer, which survives credential resets and provides ongoing access rather than a one-time harvest.
3. Detection evasion. Rust and Golang binaries produce lower static detection rates than equivalent .NET tooling. The use of AES-GCM encryption, NodeJS injection, and AI-obfuscated code further complicates static analysis.
4. Outsourced capability. The NeedleStealer payloads may be licensed or purchased rather than developed in-house. The actor may be a customer of the NeedleStealer framework, adding capability without the financial overhead of building it themselves.

Recommendations

Harden Against ClickFix and Spoofed Installer Lures

CastleLoader’s initial access relies on users downloading and executing fake installers or social engineered ClickFix-style prompts. Always validate the website and vendor when downloading new software. These campaigns make use of legitimate looking software file paths when they start installation, including a fake Microsoft Edge update dropped to %ProgramData%\EdgeUpdate\. Enforce application allowlisting to prevent execution of unsigned or unexpectedly signed binaries from %ProgramData% and user-writable directories. Train users to recognize ClickFix-style social engineering prompts that instruct them to run PowerShell or paste commands manually.

Block Known Infrastructure

Add all domains and IPs from the IOC list to your DNS blocklist, firewall deny rules, and threat intelligence platform. While stager domains are only used for a short period, hunting for malicious URLs with similar path schema (/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/v\d{1,2}) still reliably identifies new delivery domains.

Validate Code-Signing Certificates

The cluster has been observed using fraudulently obtained code-signing certificates (Mahu Agro, TECHNOLOGY APPRAISALS LIMITED) to bypass endpoint controls. Add these certificates to your blocklist. More broadly, review your endpoint policy to ensure code-signing alone is not sufficient to bypass execution controls. Always pair certificate validation with reputation checks and behavioral analysis.

Detect and Alert on Suspicious PowerShell and IronPython Activity

The two newest campaigns make use of obfuscated PowerShell stagers as the initial execution layer, followed by embedded IronPython runtimes (ipyw32.exe) as a living-off-the-land technique. Enable PowerShell Script Block Logging and Module Logging (Event IDs 4103/4104). Alert on:

• PowerShell spawning from unusual parent processes
• Execution of ipyw32.exe or any Python runtime from a suspicious location like %ProgramData% or %APPDATA%.
• Identifier ADS deletion (Mark-of-the-Web stripping) as a pre-execution evasion indicator

Review NodeJS Execution in Non-Development Environments

CastleLoader’s payload delivery mechanism for NeedleStealer is a NodeJS-based shellcode injector. Additionally, NeedleStealer is delivered alongside a legitimate Node.js binary to ProgramData\NodeJS. Alert on node.exe executing from %ProgramData% or any path outside of standard development tooling directories. In environments where Node.js is not an expected runtime, consider blocking it outright via application control policy.

How Arctic Wolf Protects Its Customers

Arctic Wolf is committed to ending cyber risk, and when active campaigns are identified, we move quickly to protect our customers. We have leveraged threat intelligence around this threat activity to enhance detections in the Aurora® Superintelligence Platform, subject to customer environment and available telemetry.

As this campaign develops, Arctic Wolf may refine detections for additional indicators of compromise and techniques leveraged by this threat.

Appendix

For additional Appendix sections referenced in this report, including Indicators of Compromise (IOCs) and MITRE ATTACK® mapping, please see our public GitHub repository.

Legal disclaimer: Attribution reflects Arctic Wolf Labs’ assessment as of the report period and may evolve with new evidence. References to threat actor identity, nexus, and intent are analytical judgments, not statements of legal fact. This alert is provided for informational purposes only and does not constitute a guarantee of detection or prevention. Defensive effectiveness varies by environment, configuration, and available telemetry.  

Additional Arctic Wolf Resources: 

• Arctic Wolf’s free Threat Intelligence newsletter: ThreatPulse Community Edition
• Arctic Wolf Tech Den 
• Arctic Wolf Blog

About Arctic Wolf Labs

Arctic Wolf Labs is a group of elite security researchers, data scientists, and security development engineers who explore security topics to deliver cutting-edge threat research on new and emerging adversaries, develop and refine advanced threat detection models with artificial intelligence and machine learning, and drive continuous improvement in the speed, scale, and detection efficacy of Arctic Wolf’s solution offerings.

Arctic Wolf Labs brings world-class security innovations to not only Arctic Wolf’s customer base, but the security community at large.