Tag: castlebot

3 Attack Reports | 0 Vulnerabilities

Attack reports

CastleLoader Activity Clusters Target Multiple Industries

Insikt Group has identified four distinct activity clusters associated with GrayBravo's CastleLoader malware, each with unique tactics and victim profiles. This supports the assessment that GrayBravo operates a malware-as-a-service model. One cluster, TAG-160, impersonates logistics firms and uses …
phishing
matanbuchus
malware-as-a-service
warmcookie
clickfix
netsupport rat
sectoprat
booking.com
logistics
castleloader
castlebot
castlerat
2025-12-09
Published: December 9, 2025
Downloadable IOCs: 87

WARMCOOKIE One Year Later: New Features and Fresh Insights

The WARMCOOKIE backdoor continues to evolve, with ongoing updates and new infections observed. Recent developments include new handlers for executing various file types, a string bank for defense evasion, and code optimizations. A campaign ID field has been added, providing context for operators. I…
backdoor
malware-as-a-service
warmcookie
castlebot
2025-10-06
Published: October 6, 2025
Downloadable IOCs: 0

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It em…
obfuscation
phishing
powershell
infostealer
hijackloader
lumma
deerstealer
anti-vm
multi-stage
castleloader
2025-09-12
castlebot
nekostealer
Published: September 12, 2025
Downloadable IOCs: 14
Click here to see more Attack Reports