Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

Arctic Wolf Labs details a cluster of CastleLoader campaigns (Urutyka, Garrigin, Noidret) that deploy NetSupport RAT and CastleStealer and now include NeedleStealer — a Rust-based desktop wallet spoofer and a Golang browser-extension installer — delivered via obfuscated PowerShell, IronPython/NodeJS injectors, and digitally signed installers; the report provides IOCs, infrastructure patterns, YARA/hunting findings, and concrete defensive mitigations.