Netskope Threat Labs

Castleloader

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

Castleloader is a malware loader that installs additional payloads on infected Windows systems. Cyberattackers distribute it through malvertising, fake software installers, and social engineering lures, and it fetches follow on families such as information stealers and remote access trojans from remote servers. The loader emphasizes evasion, checking its environment before deploying its payload, which makes its campaigns a common early stage in broader intrusion chains.

Stats

First seen
August 2025
Last seen
October 2026

Also known as

CastleLoader

Alert name variants

Alert Name
AIT:Trojan.CastleLoader.B
Script-AutoIt.Trojan.CastleLoader
Win32.Trojan.Castleloader

Related IPS Signatures

Signature Name
MALWARE-CNC CastleLoader Malware Outbound Checkin
MALWARE-CNC CastleLoader Malware Outbound Payload Request
MALWARE-CNC CastleLoader Malware Stager Outbound Payload Request

References