Hackers Using CastleRAT Malware to Attack Windows Systems and Gain Remote Access

A newly identified Remote Access Trojan (RAT) named CastleRAT is posing a significant threat to Windows systems globally. This malware, first detected in March 2025, allows attackers to obtain full remote control over affected systems.

CastleRAT is available in two primary builds: a lightweight Python version and a more robust compiled C version. The latter includes advanced functionalities such as keystroke logging, screen capture, and persistent installation methods.

The malware communicates with its command-and-control (C2) server using RC4 encryption with a hardcoded key. Once installed, it gathers and transmits system information, including the computer's name, username, machine GUID, public IP address, and product details, to the attacker.

Instructions and additional tools are delivered from the C2 server, allowing the attacker to execute remote commands.

Clipboard Data Collection and Exfiltration

CastleRAT employs clipboard data collection as a significant exfiltration technique. It operates multiple threads, each performing distinct malicious activities. The clipboard collection thread is particularly effective in targeting users who frequently copy credentials or cryptocurrency addresses, thus harvesting sensitive data such as usernames, passwords, and wallet strings.

To exfiltrate data covertly, CastleRAT hijacks the clipboard and simulates paste actions. The malware copies collected information to the clipboard and uses the SendInput() function to paste data into legitimate-looking applications, thereby minimizing network artifacts and camouflaging exfiltration activities within normal user behavior.

Organizations are advised to monitor for unusual outbound connections, single-line PowerShell downloads, unexpected executable files in user directories, and signs of RC4-encrypted traffic to identify and mitigate this threat effectively.

Based on reporting by Cyber Security News.