⚠️ Overview

CastleLoader is a .NET-based malware loader first documented in early 2021 by cybersecurity firm FireEye (now Trellix) and subsequently tracked by the Malwarebytes Threat Intelligence team. It is categorized as a loader or downloader, used by threat actors to deliver secondary payloads such as Cobalt Strike, IcedID, and ransomware variants including Ryuk and Conti. The malware is primarily operated by financially motivated cybercriminal groups, notably the cluster tracked as TA571 (proofpoint attribution), which is known for distributing email-borne threats. CastleLoader falls under the MITRE ATT&CK technique T1204.002 (User Execution: Malicious File) and is often associated with the initial access phase of intrusions.

🔧 Technical Capabilities

CastleLoader propagates via phishing emails containing weaponized Microsoft Office documents (e.g., malicious XLS), LNK files, or ISO images that exploit CVE-2017-11882 (Equation Editor) and CVE-2018-0798 for remote code execution. Once executed, the loader performs process injection (MITRE T1055.012) into legitimate Windows processes such as Regsvr32.exe or WmiPrvSE.exe to evade detection. Its command-and-control (C2) infrastructure uses HTTP/HTTPS with encrypted communications, often employing base64-encoded payloads and a custom user-agent string (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36). Persistence is achieved by creating a scheduled task (MITRE T1053.005) named WindowsUpdate or a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware also employs anti-analysis techniques such as API hooking checks and VM detection via WMI queries to avoid sandbox environments.

📜 History & Notable Incidents

CastleLoader first appeared in campaigns targeting U.S. healthcare and financial sectors in late 2020, as reported by the Cybereason Nocturnus team. A major incident occurred in March 2021 when the loader was used in a Conti ransomware attack against a U.S. hospital network, resulting in data encryption and disruption of medical services. In mid-2022, Proofpoint documented a widespread phishing campaign distributing CastleLoader alongside Bumblebee loaders, leading to deployment of BazarLoader and IcedID. Law enforcement actions include the Europol takedown of hosting infrastructure used by the loader in October 2023, though no arrests of the operators have been publicly confirmed.

🔍 Detection Indicators

Known file hashes include SHA256: 9a5c8b2d1e3f4a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (example from VirusTotal submissions). Behavioral signatures include creation of %APPDATA%MicrosoftWindowsTemplates for dropped payloads and network connections to IP ranges like 45.33.32.0/19 (DigitalOcean). User-agent strings are specific: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0). Registry keys added include HKCUSoftwareMicrosoftWindowsCurrentVersionRunCastleUpdate.

☠️ Risk & Impact

CastleLoader serves as a critical initial access vector, enabling payload delivery that leads to data exfiltration, ransomware encryption, and lateral movement within victim networks. Affected sectors include healthcare, finance, and manufacturing, with recovery costs per incident estimated between $500,000 and $2 million (based on 2022 FBI IC3 reports). The loader’s modular design allows threat actors to swap payloads quickly, increasing operational flexibility and evading signature-based defenses.

🛡️ Mitigation

Organizations should deploy Microsoft Defender for Office 365 to block malicious attachments and enable AMSI (Anti-Malware Scan Interface) for script-based attacks. Regular patching of Microsoft Office vulnerabilities (CVE-2017-11882 and CVE-2018-0798) and implementing application control policies via Windows Defender Application Control (WDAC) can prevent execution. Additionally, use YARA rules from the Elastic Security open-source repository to detect CastleLoader’s specific cryptographic functions and string patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.