NightshadeC2 (Windows)Malware
- CastleRAT
According to eSentire, NightshadeC2 demonstrates an extensive capability set, including: Reverse shell via Command Prompt/PowerShell; Download and execute DLL or EXE; Self-deletion; Remote control; Screen capture; Hidden web browsers; Keylogging; clipboard content capturing.From MISP Galaxy
Last reported 1 month ago, by Zscaler ThreatLabz3 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1204.004Malicious Copy and Paste
“…ites to deliver malware via drive-by download techniques, often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA).”
- T1036Masquerading
“In July 2026 we most frequently observed it masquerading as PDF readers.”
- T1047Windows Management Instrumentation
“…emLocator) → ExecMethod on MSFT_MpPreferencegwmi / Get-WmiObject / gcim / Get-CimInstance[class] Queries an arbitrary Windows Management Instrumentation (WMI) class(e.g., Win32_Process).CoInitializeEx + CoCreateInstance(WbemLocator) → ROOT\CIMV2 → ExecQuery → IEnumWbemClassO…”
- T1055Process Injection
“If successful, the decrypted CastleLoader binary is injected into python.exe using process injection via a shellcode-based loader.”
- T1056.001Keylogging
“Remote access trojan with several capabilities including keylogging, screen capturing, and remote shell access”
- T1543.003Windows Service
“…/ gps[name]Enumerates running processes.K32EnumProcesses + OpenProcess + GetModuleFileNameW + GetProcessTimesGet-Service—Enumerates Windows services.Dynamic advapi32: OpenSCManagerW + EnumServicesStatusExW + CloseServiceHandleStart-Process / saps / start / call / &[exe] [args…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
SloppyRAT: A New Tool For Ransomware Attacks“…a the command line shown below, which downloads and runs additional stages, leading to the deployment of CastleLoader, and ultimately, CastleRAT."C:\Users\[redacted]\AppData\Local\IronPython.3.4.2\net462\31706105999761.exe" -c "import base64,zlib,sys,subprocess as s;s.Popen([sys.…”
-
Intelligence Insights: August 2026“We had four new threats debut on our top 10 list this month: GraphSpy, Phexia, CastleRAT, and EtherRAT.”
-
Intelligence Insights: July 2026“CastleLoader (aka CastleBot) is a malware loader that can deliver various payloads, including NetSupport Manager, CastleRAT, and an unnamed .NET-based information stealer.”
Indicators in its reports
named in the reports above- gl1nto.spiintforge[.]ruin 1 report
- reeemso.forwardbox.co[.]ukin 1 report
- chainlist[.]orgin 1 report
- ai-scan[.]digitalin 1 report
- bg-transparency[.]onlinein 1 report
- linkedall[.]orgin 1 report
- golinked[.]netin 1 report
- indeed-jobs[.]netin 1 report
- cheeshomireciple[.]comin 1 report
- hxxps://mirtona[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc12in 1 report
- mirtona[.]comin 1 report
- finger.linked4x[.]comin 1 report
- linked4x[.]comin 1 report
- 9342371634011778[.]comin 1 report
- skipraid[.]comin 1 report
- hxxps://stro7121.blob.core.windows[.]net/dpp1/config.py.SloppyRATin 1 report
- stro7121.blob.core.windows[.]netin 1 report
- attempt[.]networkin 1 report
- below[.]postin 1 report
- af4c426b8c4b3b49…b7a6b06cd588in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.