Audit log

Every state-changing event for CastleLoader / NeedleStealer Crypto Wallet Malware Campaign: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-01 23:05:28Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   42uvZJVPgjzk…93BTzoqhcopysha256 → base58

   verifying row…

   canonical bytes (26630 B) ▸

   {"actor":"system:backfill","investigation_id":"c3d5c6f0-fc1d-447a-b84b-602cb3bccb6e","kind":"publish","page_slug":"castleloader-needlestealer-crypto-wallet-malware-campaign","published_at":"2026-08-01T23:05:28.629Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CastleLoader / NeedleStealer Crypto Wallet Malware Campaign","sections":[{"content":"CastleLoader is a modular, multi-stage shellcode loader first documented in early 2025. It functions as the delivery backbone for a family of related intrusion sets and has been linked by Recorded Future's Insikt Group to the threat actor cluster TAG-150, later redesignated GrayBravo. The actor is assessed to operate a malware-as-a-service (MaaS) model, selling access to its tooling and infrastructure across affiliate tiers. Arctic Wolf Labs published an expanded analysis on July 27, 2026, documenting three distinct campaigns—named Urutyka, Garrigin, and Noidret—in which CastleLoader was used to deliver NeedleStealer, a newly documented framework purpose-built for cryptocurrency wallet theft and browser session compromise. The Noidret campaign is the most operationally significant because it introduces NeedleStealer components alongside legacy payloads. All three campaigns rely on ClickFix-style social engineering and advanced evasion techniques, making them a high-severity threat to cryptocurrency holders on Windows systems.","heading":"Overview and Threat Classification","severity":"critical","sources":[{"credibility":2,"name":"Arctic Wolf Labs: Expanding the Castle — New Campaigns, New Tooling, and the NeedleStealer Connection","type":"research","url":"https://arcticwolf.com/resources/blog/castleloader-new-campaigns-new-tooling-and-the-needlestealer-connection/"},{"credibility":2,"name":"Recorded Future: GrayBravo's CastleLoader Activity Clusters Target Multiple Industries","type":"research","url":"https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries"},{"credibility":2,"name":"Recorded Future: From CastleLoader to CastleRAT — TAG-150 Advances Operations","type":"research","url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"}]},{"content":"The CastleLoader infection chain is initiated through fake software installers and ClickFix-style social engineering lures. Huntress documented an early variant called BackgroundFix, published April 30, 2026, in which deceptive websites mimicking background-removal services prompted users to execute clipboard-injected commands via the Windows Run prompt. These commands used the legacy finger.exe utility to retrieve a PowerShell script, which then downloaded a Python embeddable distribution and ran a multi-layered downloader. Subsequent campaign variants include NSIS droppers masquerading as Microsoft Edge updates (Garrigin) and obfuscated PowerShell scripts delivering IronPython-based loaders followed by NetSupport RAT and a VNC-based tool (Urutyka). The Noidret campaign deploys NeedleStealer components as its primary crypto-targeting payload. A key evasion technique documented by CyberPress in July 2026 involves digitally signed installers—including EV-signed MSI packages—that strip the Mark-of-the-Web (MOTW) attribute from downloaded files. Because MOTW triggers Windows SmartScreen warnings, its removal allows malicious payloads to execute without standard OS-level prompts, materially increasing infection success rates. Payloads are loaded entirely in memory using reflective PE injection, avoiding disk-based forensic artifacts. CastleLoader employs API hashing with an alternating-step algorithm (initial state 0xAAAAAAAA), NtAllocateVirtualMemory for shellcode allocation to bypass EDR hooks, and PEB manipulation to masquerade payloads as legitimate processes.","heading":"Infection Chain and Delivery Mechanisms","severity":"critical","sources":[{"credibility":2,"name":"Huntress: ClickFix Removes Your Background but Leaves the Malware (BackgroundFix campaign)","type":"research","url":"https://www.huntress.com/blog/clickfix-castleloader-backgroundfix"},{"credibility":2,"name":"CyberPress: Digitally Signed CastleLoader Installers Strip Mark-of-the-Web and Inject Payloads Into Memory","type":"news_article","url":"https://cyberpress.org/signed-castleloader-evades-motw/"},{"credibility":2,"name":"GBHackers: CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions","type":"news_article","url":"https://gbhackers.com/castleloader-campaign-deploys-needlestealer/"},{"credibility":2,"name":"SOC Prime: CastleLoader Expands with NeedleStealer and New Tooling","type":"research","url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"}]},{"content":"NeedleStealer is a two-component framework first documented by a defensive security provider identified as Beelzebub in a C2 analysis, and subsequently integrated into CastleLoader campaigns by the Noidret cluster. The first component is a Rust-based desktop wallet spoofer that presents victims with convincing imitations of the recovery-seed entry screens used by Ledger, Trezor, and Exodus hardware and software wallets. The interface is designed to be functionally indistinguishable from the legitimate wallet recovery UI. A victim who enters their 12- or 24-word BIP-39 mnemonic seed phrase into this spoofer surrenders complete, irrevocable control of all associated cryptocurrency holdings to the attacker—seed phrases are the master cryptographic secret from which all wallet private keys are derived. The Rust payload is delivered as a ZIP archive extracted to the ProgramData\\NodeJS directory alongside a legitimate Node.js binary and two AES-GCM encrypted payload files. A NodeJS injector script, assessed to be AI-assisted in its original form before obfuscation, decrypts and loads an approximately 8 KB x64 shellcode stub, which then reflectively injects the Rust wallet spoofer. The choice of Rust for this payload is deliberate: Rust and Golang binaries produce significantly lower static detection rates in antivirus and EDR tooling than equivalent .NET or Python code. The second NeedleStealer component, written in Golang, installs malicious browser extensions. The extensions are disguised as legitimate-looking tools such as ad blockers to avoid user suspicion. Once installed, they enable persistent hijacking of browser sessions, theft of session tokens, and credential harvesting from web applications—including cryptocurrency exchange accounts and web-based wallet dashboards.","heading":"NeedleStealer: Cryptocurrency Wallet Targeting","severity":"critical","sources":[{"credibility":2,"name":"Arctic Wolf Labs: Expanding the Castle — NeedleStealer Connection (via SOC Prime summary)","type":"research","url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"},{"credibility":2,"name":"GBHackers: CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions","type":"news_article","url":"https://gbhackers.com/castleloader-campaign-deploys-needlestealer/"},{"credibility":2,"name":"CyberSecurityNews: Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions","type":"news_article","url":"https://cybersecuritynews.com/hackers-are-using-fake-crypto-wallet-screens/"}]},{"content":"Arctic Wolf Labs identified three operationally distinct but infrastructure-related campaigns within the July 2026 CastleLoader activity. The Urutyka campaign leverages obfuscated PowerShell scripts to deliver IronPython-based loaders, ultimately deploying NetSupport RAT for remote interactive access and a VNC-based remote access tool assessed to be Lobshot. The Garrigin campaign introduces an NSIS dropper disguised as a Microsoft Edge update, which deploys CastleStealer—a .NET-based infostealer—via a C/C++ injector. Garrigin stores payloads entirely in memory and removes forensic artifacts post-execution. The Noidret campaign is the most significant development in this cluster: it adds both NeedleStealer components to the delivery chain alongside NetSupport RAT and CastleStealer, making it the primary crypto-targeting variant. Each campaign uses different payload combinations and supporting infrastructure, suggesting deliberate compartmentalization to limit attribution and reduce the blast radius of defender disruption.","heading":"Three Campaign Clusters: Urutyka, Garrigin, and Noidret","severity":"critical","sources":[{"credibility":2,"name":"Arctic Wolf Labs: Expanding the Castle (via GBHackers)","type":"news_article","url":"https://gbhackers.com/castleloader-campaign-deploys-needlestealer/"},{"credibility":2,"name":"SOC Prime: CastleLoader Expands with NeedleStealer and New Tooling","type":"research","url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"}]},{"content":"Alongside NeedleStealer, CastleLoader campaigns continue to deploy CastleStealer, a custom .NET infostealer documented by Huntress in April 2026. CastleStealer extracts browser credentials by accessing Login Data SQLite databases and decrypting master keys via DPAPI. It enumerates IndexedDB storage to harvest vault data from cryptocurrency browser extensions including MetaMask, Phantom, Trust Wallet, and Ronin. It steals Telegram tdata session directories enabling account takeover without password authentication, and collects Discord tokens via Local Storage. CastleStealer uses the Windows Restart Manager API to unlock files held open by running processes, allowing extraction without process termination. File collection targets .exe, .dll, .lnk, .tmp, .log, and wallet-related files per C2-supplied configuration. C2 communication for CastleStealer operates over raw TCP. NetSupport RAT is deployed via scheduled tasks for persistent remote interactive access, enabling hands-on operator activity on compromised hosts. In Bitdefender's analysis of campaigns observed December 2025 through January 2026, CastleLoader was also used to deliver LummaStealer (LummaC2), a mature MaaS infostealer with extensive credential and clipboard harvesting capabilities. Infrastructure overlap between CastleLoader and LummaStealer operations suggests shared hosting providers or coordinated MaaS affiliate relationships.","heading":"CastleStealer and Legacy Payload Capabilities","severity":"high","sources":[{"credibility":2,"name":"Huntress: ClickFix Removes Your Background but Leaves the Malware","type":"research","url":"https://www.huntress.com/blog/clickfix-castleloader-backgroundfix"},{"credibility":2,"name":"Bitdefender: LummaStealer Is Getting a Second Life Alongside CastleLoader","type":"research","url":"https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader"},{"credibility":2,"name":"Bleeping Computer: LummaStealer Infections Surge After CastleLoader Malware Campaigns","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/lummastealer-infections-surge-after-castleloader-malware-campaigns/"}]},{"content":"Confirmed malicious domains associated with the July 2026 campaigns include goodbyetelegramm.com, urutyka.com, and eazysitebuilder.com. Two additional domains—kaneta.cc and monblare.com—were observed hosted on shared infrastructure with valid SSL certificates extending into August 2026. At the time of Arctic Wolf Labs' analysis, kaneta.cc showed minimal traffic consistent with staging or testing, and monblare.com showed zero VirusTotal detections, indicating pre-positioning for future operations. Confirmed malicious IPs include 91.92.33.167 and 179.132.128.189. Earlier BackgroundFix campaign infrastructure included the domains cheeshomireciple.com and trindastal.com, along with eight background-removal lure domains. Recorded Future's TAG-150 attribution identified 15 CastleLoader C2 IP addresses and 12 distinct domains, with hosting concentrated at FEMO IT SOLUTIONS LIMITED, servinga GmbH, and Eonix Corporation. Admin panels were typically served on ports 80 for C2 and ports 5050 or 9999 for administrative access. A distinctive DNS fingerprint—CastleLoader's deliberate triggering of failed lookups to nonexistent domains using the pattern randomstring.randomstring—provides a behavioral detection opportunity. The legitimate Node.js binary dropped to ProgramData\\NodeJS is used as a living-off-the-land binary (LOLBin) to load and execute malicious payloads, making execution from that path a high-fidelity detection indicator. A single CastleLoader sample hash documented by PolySwarm is 05ecf871c7382b0c74e5bac267bb5d12446f52368bb1bfe5d2a4200d0f43c1d8.","heading":"Infrastructure and Indicators of Compromise","severity":"high","sources":[{"credibility":2,"name":"SOC Prime: CastleLoader Expands with NeedleStealer and New Tooling (IOCs)","type":"research","url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"},{"credibility":2,"name":"Recorded Future: From CastleLoader to CastleRAT — TAG-150 Infrastructure Analysis","type":"research","url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"},{"credibility":2,"name":"PolySwarm: CastleLoader Sample Analysis","type":"research","url":"https://blog.polyswarm.io/castleloader"},{"credibility":2,"name":"Huntress: BackgroundFix Campaign IOCs","type":"research","url":"https://www.huntress.com/blog/clickfix-castleloader-backgroundfix"}]},{"content":"The CastleLoader ecosystem is attributed to a threat cluster designated TAG-150 by Recorded Future's Insikt Group, subsequently redesignated GrayBravo. The actor has been active since at least March 2025 and is assessed to operate a malware-as-a-service model with multiple affiliate tiers, with 2023-era LummaStealer pricing ranging from $250 to $20,000. The actor demonstrates rapid development cycles, technical sophistication, and documented responsiveness to public research disclosures. Recorded Future identified four operational sub-clusters within TAG-150: TAG-160 (logistics-focused activity dating to March 2025), TAG-161 (Booking.com impersonation campaigns beginning June 2025), a third cluster using Steam Community profiles as C2 dead-drop resolvers, and a fourth cluster using malvertising via fake software updates. Infrastructure tiering is sophisticated: victim-facing C2 servers sit behind VPS intermediaries accessible via RDP, which in turn communicate through a tier of VPS servers with shared TLS certificates, with possible backup capacity at a fourth tier. Insikt Group additionally noted potential infrastructure overlap with Play Ransomware operations, though the connection remains circumstantial and may reflect shared victim targeting rather than organizational relationship. No confirmed nation-state attribution has been made. The threat actor's use of ClickFix lures, signed EV certificates, and Rust/Golang payloads reflects deliberate choices to maximize operational longevity and evade commodity defenses.","heading":"Threat Actor Attribution","severity":"high","sources":[{"credibility":2,"name":"Recorded Future: GrayBravo's CastleLoader Activity Clusters Target Multiple Industries","type":"research","url":"https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries"},{"credibility":2,"name":"Recorded Future: From CastleLoader to CastleRAT — TAG-150 Advances Operations","type":"research","url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"}]},{"content":"Organizations and individual crypto holders should take the following steps based on the confirmed TTPs of this campaign. First, monitor for and block the confirmed C2 domains and IPs at the DNS and firewall layers. Second, enforce application allowlisting that prevents execution of unsigned binaries from %ProgramData% paths, particularly %ProgramData%\\NodeJS. Third, enable PowerShell Script Block Logging and monitor for suspicious PowerShell execution patterns, especially those involving finger.exe, NtAllocateVirtualMemory, or base64/zlib encoded payloads. Fourth, audit browser extensions across the organization and remove any that cannot be verified against a known-good allowlist. Fifth, verify the authenticity of any code-signing certificates on downloaded installers—EV certificates are not a guarantee of legitimacy. Sixth, treat any software installer that presents a CAPTCHA or asks users to run commands as a high-confidence phishing indicator. Seventh, never enter a seed phrase into any software presented during or after a software installation process—no legitimate wallet recovery flow is triggered by a third-party installer. The approximately 8 KB x64 shellcode stub used in NeedleStealer delivery, the RunMRU registry entries created during ClickFix execution, and NodeJS binary execution from %ProgramData% are each high-fidelity behavioral indicators available for YARA and EDR rule development.","heading":"Defensive Recommendations and Detection Guidance","severity":"medium","sources":[{"credibility":2,"name":"SOC Prime: CastleLoader Expands with NeedleStealer — Detection and Mitigation","type":"research","url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"},{"credibility":2,"name":"CyberPress: Signed CastleLoader Evades MOTW","type":"news_article","url":"https://cyberpress.org/signed-castleloader-evades-motw/"}]},{"content":"The ClickFix technique used by CastleLoader is part of a broad and growing trend in malware distribution that exploits Windows' clipboard and Run-dialog functionality to bypass traditional email and browser download defenses. Microsoft documented a DNS-based ClickFix variant in February 2026 that used nslookup for malware staging. Related 2026 campaigns include OkoBot, a separate malware framework using ClickFix and a component called SeedHunter to inject seed phrase phishing directly into legitimate Ledger and Trezor application windows, documented by The Hacker News and GBHackers in July 2026. A macOS-targeted ClickFix variant distributing MacSync via fake AI tool installers was documented in March 2026. The convergence of multiple threat actors on the ClickFix delivery vector against cryptocurrency wallet users indicates a broadly recognized attack surface, not a single actor's innovation. Crypto holders are advised to treat any installation process that requests clipboard interaction, script execution, or recovery phrase entry with extreme suspicion regardless of the apparent software brand.","heading":"Broader ClickFix Campaign Context","severity":"medium","sources":[{"credibility":2,"name":"The Hacker News: OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps","type":"news_article","url":"https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html"},{"credibility":2,"name":"GBHackers: OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases","type":"news_article","url":"https://gbhackers.com/okobot-malware-uses-clickfix/"},{"credibility":2,"name":"The Hacker News: Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging","type":"news_article","url":"https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html"}]}],"sources_used":[{"credibility":2,"name":"Arctic Wolf Labs: Expanding the Castle — New Campaigns, New Tooling, and the NeedleStealer Connection","type":"research","url":"https://arcticwolf.com/resources/blog/castleloader-new-campaigns-new-tooling-and-the-needlestealer-connection/"},{"credibility":2,"name":"GBHackers: CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions","type":"news_article","url":"https://gbhackers.com/castleloader-campaign-deploys-needlestealer/"},{"credibility":2,"name":"CyberSecurityNews: Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions","type":"news_article","url":"https://cybersecuritynews.com/hackers-are-using-fake-crypto-wallet-screens/"},{"credibility":2,"name":"CyberPress: Digitally Signed CastleLoader Installers Strip Mark-of-the-Web and Inject Payloads Into Memory","type":"news_article","url":"https://cyberpress.org/signed-castleloader-evades-motw/"},{"credibility":2,"name":"Bleeping Computer: LummaStealer Infections Surge After CastleLoader Malware Campaigns","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/lummastealer-infections-surge-after-castleloader-malware-campaigns/"},{"credibility":2,"name":"SOC Prime: CastleLoader Expands with NeedleStealer and New Tooling","type":"research","url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"},{"credibility":2,"name":"Huntress: ClickFix Removes Your Background but Leaves the Malware","type":"research","url":"https://www.huntress.com/blog/clickfix-castleloader-backgroundfix"},{"credibility":2,"name":"Recorded Future: GrayBravo's CastleLoader Activity Clusters Target Multiple Industries","type":"research","url":"https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries"},{"credibility":2,"name":"Recorded Future: From CastleLoader to CastleRAT — TAG-150 Advances Operations with Multi-Tiered Infrastructure","type":"research","url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"},{"credibility":2,"name":"Bitdefender Labs: LummaStealer Is Getting a Second Life Alongside CastleLoader","type":"research","url":"https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader"},{"credibility":2,"name":"PolySwarm: CastleLoader Analysis","type":"research","url":"https://blog.polyswarm.io/castleloader"},{"credibility":2,"name":"The Hacker News: OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps","type":"news_article","url":"https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html"},{"credibility":2,"name":"GBHackers: OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases","type":"news_article","url":"https://gbhackers.com/okobot-malware-uses-clickfix/"},{"credibility":2,"name":"The Hacker News: Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging","type":"news_article","url":"https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html"},{"credibility":3,"name":"Cryptika: Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions","type":"news_article","url":"https://www.cryptika.com/hackers-are-using-fake-crypto-wallet-screens-to-steal-recovery-phrases-and-browser-sessions/"}],"summary":"CastleLoader is an active multi-stage shellcode loader attributed to the threat actor cluster designated GrayBravo (also tracked as TAG-150) that has been operational since at least March 2025. In campaigns identified in July 2026, Arctic Wolf Labs documented the loader's expansion to deliver NeedleStealer, a modular framework comprising a Rust-based desktop wallet spoofer targeting Ledger, Trezor, and Exodus users and a Golang-based malicious browser extension installer that enables persistent session hijacking. The combined campaign uses ClickFix-style social engineering, digitally signed installers to strip Mark-of-the-Web protections, and in-memory payload injection to evade endpoint detection, with staged infrastructure bearing SSL certificates valid into August 2026 indicating ongoing operations.","timeline":[{"date":"2025-03-01","event":"TAG-150 (GrayBravo) earliest confirmed activity, deploying CastleLoader infrastructure","source":"Recorded Future Insikt Group","source_url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"},{"date":"2025-05-01","event":"CastleLoader campaigns actively targeting U.S. entities observed by PolySwarm; 469 of 1,634 attempted compromises succeed (28.7% infection rate)","source":"PolySwarm Blog","source_url":"https://blog.polyswarm.io/castleloader"},{"date":"2025-08-01","event":"CastleRAT Python variant first identified; TAG-150 expands from loader to full RAT capability","source":"Recorded Future: From CastleLoader to CastleRAT","source_url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"},{"date":"2025-09-01","event":"Recorded Future attributes campaign cluster to TAG-150, documenting four sub-clusters and four-tier C2 infrastructure","source":"Recorded Future Insikt Group","source_url":"https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations"},{"date":"2025-12-01","event":"CastleLoader begins delivering LummaStealer; Bitdefender observes surge in infections peaking in India, the US, and Europe through January 2026","source":"Bitdefender Labs","source_url":"https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader"},{"date":"2026-04-30","event":"Huntress publishes BackgroundFix campaign analysis documenting ClickFix chain delivering CastleLoader, CastleStealer, and NetSupport RAT via fake background-removal websites","source":"Huntress","source_url":"https://www.huntress.com/blog/clickfix-castleloader-backgroundfix"},{"date":"2026-07-27","event":"Arctic Wolf Labs publishes expanded CastleLoader analysis identifying three new campaigns (Urutyka, Garrigin, Noidret) and the NeedleStealer framework with Rust wallet spoofer and Golang browser extension components","source":"Arctic Wolf Labs","source_url":"https://arcticwolf.com/resources/blog/castleloader-new-campaigns-new-tooling-and-the-needlestealer-connection/"},{"date":"2026-07-28","event":"GBHackers and CyberPress report on the NeedleStealer connection and MOTW-stripping via signed installers, noting staged infrastructure with SSL certificates valid into August 2026","source":"GBHackers / CyberPress","source_url":"https://gbhackers.com/castleloader-campaign-deploys-needlestealer/"},{"date":"2026-08-01","event":"As of this investigation date, kaneta.cc and monblare.com infrastructure retains valid SSL certificates and is assessed to be staged for active or imminent deployment","source":"Arctic Wolf Labs (via SOC Prime)","source_url":"https://socprime.com/active-threats/new-castle-campaigns-reveal-evolving-tooling-and-needlestealer-ties/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8eea228a-2631-4804-8646-f86cc997aefdcopy