GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries

Insikt Group tracks GrayBravo (formerly TAG-150), a technically sophisticated malware-as-a-service operator responsible for CastleLoader, CastleRAT and related tooling; the report identifies four distinct activity clusters (including TAG-160 targeting logistics and TAG-161 impersonating Booking.com), details multi-tiered RC4-encrypted C2 infrastructure, numerous IoCs (domains, IPs, Steam deaddrops, Snort/YARA/Sigma rules), and provides mitigations to detect and block infections and associated infrastructure.