Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

Arctic Wolf Labs documents a cluster of related CastleLoader campaigns (Urutyka, Garrigin, Noidret) that deliver CastleStealer and NetSupport RAT and now incorporate NeedleStealer — a Rust-based wallet spoofer and a Golang browser-extension installer — using multi-stage loaders (obfuscated PowerShell, IronPython, NodeJS shellcode injectors) and even digitally signed installers; the report includes infrastructure IOCs, YARA retrohunt results, observed indicators, and practical mitigations to detect and block these targeted, high-value cryptocurrency-focused intrusions.