Behind the Walls: Techniques and Tactics in Castle RAT Client Malware

Date: 12/26/2025

Severity: High

Summary

Multiple threat groups are deploying a variety of malware to compromise hosts and networks, with CastleRAT emerging as one of the latest payloads observed this year. First identified around March 2025, CastleRAT is a Remote Access Trojan available in two primary variants: a Python-based version and a compiled C version. While both share the same core objectives, they differ in functionality and propagation methods. The Python variant is more lightweight and easier to analyze, whereas the C variant is more robust and supports additional capabilities. 

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference: 

https://www.splunk.com/en_us/blog/security/castlerat-malware-detection-splunk-mitre-attck.html