Stealthy CastleLoader Malware Attacking US Government Agencies and Critical Infrastructure

Cybersecurity: CastleLoader Malware Analysis

A sophisticated malware loader known as CastleLoader has emerged as a critical threat to US government agencies and critical infrastructure organizations. First identified in early 2025, this malware has been used as the initial access point in coordinated attacks targeting multiple sectors, including federal agencies, IT firms, logistics companies, and essential infrastructure providers across North America and Europe.

CastleLoader operates as a multi-stage loader that delivers secondary payloads directly into system memory, making it exceptionally difficult for traditional security defenses to detect. The malware's primary function is to establish an initial foothold on compromised systems, after which it deploys tools such as information stealers and remote access trojans, giving attackers complete control over infected networks.

Security researchers have documented that a single CastleLoader campaign impacted approximately 460 distinct organizations, with a particular focus on compromising government systems in the United States. The loader's universal nature and high infection rate have made it a preferred tool among threat actors seeking to compromise high-value targets while evading detection systems.

Infection Chain and Evasion Mechanisms

CastleLoader employs social engineering techniques known as ClickFix, where victims are deceived through fake software update prompts or system verification messages. When users comply, they unknowingly execute malicious commands that deliver CastleLoader as the second stage of the attack chain. This approach has been effective at bypassing user awareness training and initial security controls.

The malware arrives as an Inno Setup installer file containing multiple components, including AutoIt3.exe and a compiled AutoIt script stored as freely.a3x. The AutoIt script initiates the next phase by launching the jsc.exe process with the CREATE_SUSPENDED flag. This allows the malware to inject a fully functional PE executable directly into the jsc.exe memory space using a refined process hollowing technique.

By allocating memory within the target process and using WriteProcessMemory, the malware writes its PE image into this region. The PEB (Process Environment Block) address is extracted, and the ImageBaseAddress field is overwritten to ensure correct loading of the injected code. This technique differs from traditional process hollowing, avoiding detection mechanisms that monitor for this activity.

The final stages involve using SetThreadContext and ResumeThread to redirect execution to the injected payload's entry point. This keeps the malicious code confined to memory, rendering traditional static signature-based detection ineffective. Security monitoring tools often fail to detect this sophisticated execution model, making CastleLoader a significant threat to organizations lacking modern memory-based detection capabilities.

Based on reporting by Cyber Security News.