Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

Arctic Wolf Labs analyzes a cluster of CastleLoader campaigns (Urutyka, Garrigin, Noidret) that now incorporate NeedleStealer — Rust and Golang-based payloads that steal cryptocurrency seeds and install malicious browser extensions — detailing infection chains, associated IOCs (domains, IPs, signed installers), reusable shellcode loaders, and recommended mitigations for detection and prevention.