TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations
CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.
More info