Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

Recorded Future's Insikt Group has identified four distinct threat activity clusters utilizing CastleLoader, a malware loader now confirmed to be offered under a malware-as-a-service (MaaS) model. The threat actor behind CastleLoader, named GrayBravo, previously tracked as TAG-150, demonstrates the tool's widespread adoption across multiple threat groups, highlighting its role as a versatile and commercially available malware delivery platform.