eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure
Bottom Line: Information on TAG-150's malware infrastructure has emerged, providing details on the toolkit used by the group, including the ClickFix Initial Access Vector to deploy the CastleLoader and CastleRAT malware, along with the group's operational ecosystem.
On September 4th, 2025, Insikt Group released a report on a large infrastructure set operated by the threat actor tracked as TAG-150, known for deploying malware such as CastleLoader (CastleBot). The report highlights TAG-150's extensive toolkit and operational ecosystem, which utilizes various file-sharing services, messaging platforms, and specialized utilities, including an anti-detection service.
TAG-150 relies on a structured, multi-tiered Command-and-Control (C2) infrastructure in which the first tier directly communicates with infected victims while additional tiers provide redundancy, resilience, and operational support. Infections are mostly initiated through Cloudflare-themed “ClickFix” phishing attacks or fraudulent GitHub repositories masquerading as legitimate applications. These campaigns have proven to be highly effective, achieving an estimated 28.7 percent infection success rate among users who clicked on the malicious links. The group also uses various third-party services to facilitate its operations including file hosting sites like temp.sh and mega.nz, privacy tools such as Oxen (Lokinet), malware scanner Kleenscan, and cryptocurrency exchanges like simpleswap.io.
The group maintains an extensive malware arsenal. CastleLoader and CastleBot are primarily used for initial access and payload delivery, while WarmCookie and SectopRAT provide persistence and remote control. The most notable addition is CastleRAT, which has been identified in both Python and C versions. The Python variant is lightweight and primarily designed for stealth. It allows attackers to gather system information, execute payloads, and self-delete to minimize forensic evidence. The C variant, by contrast, contains significantly more features. It enables geolocation lookups through ip-api[.]com, captures keystrokes and screenshots, transfers files, terminates processes, establishes persistence, and communicates with C2 servers using RC4 encryption. This variant also incorporates the novel use of Steam Community pages as C2 channels, which enhances stealth and reduces the likelihood of detection.
eSentire Threat Intelligence Analysis:
TAG-150 represents a rapidly evolving threat actor group that has demonstrated the ability to create proprietary malware families and manage a resilient infrastructure. The introduction of CastleRAT alongside CastleLoader and CastleBot highlights the group’s intent to sustain long-term operations and continuously improve its toolset. The multi-tiered infrastructure used by TAG-150 enables operational redundancy and complicates takedown efforts. By separating victim-facing servers from higher-tier routing and backup systems, TAG-150 makes it significantly harder for defenders to disrupt C2 channels.
Recorded Future’s investigation identified a French ISP IP that communicated with both a CastleLoader panel (associated with TAG-150) and a WarmCookie C2 server tied to a Play ransomware victim. This overlap could suggest possible infrastructure sharing or tool reuse. IBM X-Force and Catalyst state that CastleLoader has been used to distribute DeerStealer, RedLine, StealC, NetSupport RAT, SectopRAT, MonsterV2, and other loaders like Hijack Loader. Given these findings, it is possible that TAG-150 will expand its distribution methods, release additional malware variants, and potentially operate as part of a broader Malware-as-a-Service (MaaS) ecosystem.
The development of CastleRAT in both Python and C demonstrates a deliberate effort to diversify its capabilities. It is important to note that eSentire’s Threat Response Unit (TRU) has identified both variants and tracks them under the name NightshadeC2. eSentire’s observations are documented in a blog post titled "New Botnet Emerges from the Shadows: NightshadeC2."
eSentire continues to observe incidents involving ClickFix as the initial access method. To defend against ClickFix, organizations must deploy Endpoint agents to all supported assets and provide users with regular security training, including a specific focus on currently observed threats such as ClickFix. In addition, technical controls around the use of the Windows Run prompt or similar functions that threat actors could abuse should be evaluated.
Zero-Day Vulnerability Within Sitecore Products Exploited
Bottom Line: A critical zero-day vulnerability, CVE-2025-53690, impacting Sitecore products has been confirmed to be exploited in the wild. Threat actors leveraged the flaw to gain remote access, further performing reconnaissance and establishing persistence in the compromised network.
On September 3rd, 2025, the Mandiant Threat Defense team published a report providing details on a critical zero-day vulnerability that they discovered, impacting Sitecore deployments. The vulnerability, tracked as CVE-2025-53690 (CVSS: 9.0) is a ViewState deserialization flaw impacting Sitecore's Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud products, and can lead to Remote Code Execution (RCE) on compromised servers. Exploitation of the vulnerability involves leveraging a “sample machine key that had been exposed in Sitecore deployment guides from 2017 and earlier”. Mandiant reported the vulnerability to Sitecore after discovering its exploitation during an investigation involving a third-party organization, which was used by the threat actors to establish initial access to the environment. Sitecore published an advisory for the vulnerability on September 2nd, 2025, providing solutions for organizations to address the vulnerability.
ViewStates are an ASP.NET feature that are designed to persist the state of webpages, by storing it within a hidden HTML field. A ViewState deserialization attack can occur when validation mechanisms used by the server to deserialize a ViewState are absent or bypassed, causing the server to be unable to differentiate between legitimate and malicious ViewState payloads when received. Within the attack observed by Mandiant, threat actors utilized the exposed ASP.NET machine key to send a specially crafted ViewState payload to the server, enabling the deployment of WeepSteel. WeepSteel is a reconnaissance tool that is designed to gather user, system, and network information, and exfiltrate this data to attacker Command-and-Control (C2) servers.
The threat actor used this exploit to gain Network Service privilege access to the server and performed additional reconnaissance. Public directories were used for staging additional payloads, and the threat actors utilized open-source tooling to perform further actions. The EarthWorm tool was used to establish covert channels and C2 communications, DWAgent was deployed to establish remote access to the compromised assets, and the SharpHound tool was utilized to perform Active Directory (AD) enumeration. The attackers were able to elevate privileges to administrator access, create additional administrative accounts, and move laterally within the environment using Remote Desktop Protocol (RDP). Mandiant states that they “successfully disrupted the attack shortly after initiating rapid response, which ultimately prevented us (Mandiant) from observing the full attack lifecycle”.
eSentire Threat Intelligence Analysis:
Mandiant does not provide any attribution to a specific threat group or any potential state-affiliation within their analysis, or any suggestion of possible motivation behind the attack. However, the usage of a previously undisclosed zero-day vulnerability within the attacks does highlight the potential involvement of a technically skilled threat actor behind the activity. Zero-day vulnerabilities are typically seen being targeted by APT groups, state-sponsored threat actors, or cybercriminal groups that are well-funded, rather than lower-skilled threat actors. An example of this is the recently observed deserialization zero-day vulnerability impacting on-premises SharePoint servers (CVE-2025-53770), which was observed being exploited by the Chinese state-sponsored threat actors Linen Typhoon and Violet Typhoon in July 2025.
CVE-2025-53690 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 4th, 2025, following Microsoft's report detailing active exploitation of the flaw. The addition of CVE-2025-53690 to the KEV requires that federal agencies within the United States apply relevant mitigations by September 25th, 2025. This is notable as CISA is providing the standard three-week timeframe to apply fixes for this critical vulnerability, when similar vulnerabilities that were added had a patch requirement of one day. It may be likely that the standard timeframe was given for CVE-2025-53690 due to a lack of publicly available Proof-of-Concept (PoC) exploit code and reports of widespread exploitation. However, impacted organizations should apply the recommended mitigations provided by Sitecore as soon as possible.
Threat actors utilizing exposed ASP.NET machine keys is not a novel technique, where Microsoft reported on another campaign in February 2025, involving threat actor’s usage of publicly available ASP.NET machine keys to inject malicious code, resulting in the deployment of the Godzilla post-exploitation framework. Similar to the recently observed Sitecore attack, no attribution was provided to a specific threat actor. However, organization’s continued usage of publicly available ASP.NET keys, which is similar to organizations refraining from changing default passwords on externally facing devices, continues to provide an avenue for threat actors to establish initial access to target environments. Mandiant has stated that in response to this, Sitecore has updated its deployments to "automatically generate a unique machine key", and that "affected customers have been notified".
Amazon Disrupts Watering Hole Campaign by Russia’s APT29
Bottom Line: The Russian state-sponsored threat actor, APT29, was identified carrying out watering hole attacks, in order to conduct device code authentication phishing, which resulted in the theft of access credentials that may be used for intelligence gathering purposes.
On August 29th, 2025, Amazon’s threat intelligence team revealed a watering-hole campaign linked to the Russian state-sponsored group APT29 (aka Midnight Blizzard and Cozy Bear). In this operation, the attackers compromised legitimate websites to trick victims into authorizing attacker-controlled devices through Microsoft’s device code authentication process, ultimately enabling unauthorized access to the victims’ Microsoft accounts.
Amazon discovered that the attackers embedded malicious JavaScript (JS) code into compromised websites, causing nearly 10% of user traffic to be redirected to attacker-controlled domains. These domains impersonated Cloudflare verification pages to appear credible, tricking victims into a device code authentication phishing attack. Analysis of the malicious JS code showed that the attackers implemented several detection evasion techniques. These included randomizing redirects to affect only a small portion of visitors, hiding malicious code through Base64 encoding, using cookies to avoid repeatedly redirecting the same user, and quickly shifting to new infrastructure when existing domains were blocked.
Amazon confirmed that Amazon Web Service (AWS) systems were not compromised, and no direct impact was observed on AWS services or infrastructure. Amazon disrupted the campaign by isolating the affected EC2 instances, collaborating with Cloudflare and other providers to take down the attacker’s domains, and sharing intelligence with Microsoft to support further disruption efforts.
eSentire Threat Intelligence Analysis:
APT29, associated with Russia’s Foreign Intelligence Service (SVR), is known for sophisticated phishing campaigns targeting diplomatic organizations, government entities, and critical infrastructure for cyber espionage. The group has engaged in opportunistic operations, including corporate espionage and supply chain attacks. The recent watering-hole campaign exemplifies the shift in techniques, highlighting APT29’s evolving tactics to broaden the reach of their intelligence gathering activities.
APT29’s watering-hole campaign showcased several sophisticated detection evasion techniques that contributed to its low detection rate. The malicious JS redirected only around 10% of visitors to attacker-controlled domains at random, helping the campaign remain stealthy and less detectable, while Base64 encoding was used to obfuscate the code and hinder forensic analysis. Session cookies ensured that users were not redirected multiple times, reducing suspicion. Additionally, the actor’s rapid shift to new infrastructure when blocked highlighted the campaign’s operational resilience.
The past campaigns highlight APT29’s steady evolution and continual adoption of new techniques and payloads to advance their intelligence-gathering objectives. In 2022, Google reported that APT29 posed as embassy notices, leveraging compromised email accounts and Atlassian Trello for C2 to deploy BEATDROP and BOOMMIC downloaders. Following the Russia-Ukraine war, the group focused on Ukraine, with phishing campaigns distributing HTML attachments containing JS dropper, dubbed ROOTSAW. In October 2024, Amazon disrupted APT29’s attempt to use domains impersonating AWS to deliver Remote Desktop Protocol (RDP) files linked to actor-controlled resources. In April 2025, APT29 targeted European diplomats via phishing to install GRAPELOADER, an initial-stage tool for fingerprinting, persistence, and payload delivery. Additionally, in June 2025, Google reported that APT29 conducted phishing campaigns targeting academics and critics of Russia, leveraging application-specific passwords (ASPs).
The recent watering-hole campaign illustrates a continued evolution in APT29’s tactics, highlighting their adoption of novel methods. The group also shared techniques with other Russian threat actors, with Storm-2372 notably employing device code authentication phishing in their past campaign. According to Amazon, the campaign’s primary objective was to harvest Microsoft credentials, and no malware was observed in the campaign, as seen in the past campaigns. After the disruption, the threat actor was seen migrating to new infrastructure, indicating a high likelihood of the campaign continuing despite Amazon’s intervention. Such campaigns are likely to leverage the stolen credentials for future intelligence gathering activities.
Organizations are advised to strengthen defenses through a combination of user education and technical controls. Conducting Phishing Security and Awareness Training (PSAT) can help employees recognize and avoid common phishing techniques. Enforcing Multi-Factor Authentication (MFA) across all accounts provides an additional layer of protection against credential theft. To mitigate risks from device code authentication phishing, organizations should block device code flow where feasible and implement conditional access policies that enforce restrictions based on device compliance, location, and risk level. Complementing these measures with continuous monitoring of authentication events will improve the ability to detect and respond to malicious activity.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
