GrayBravo

THREAT ACTOR PROFILE

GrayBravo

TAG-150

GrayBravo is a financially motivated operator behind the CastleLoader and CastleRAT malware-as-a-service ecosystem, active since early 2025. It delivers loaders, stealers and RATs through ClickFix lures, fake GitHub repositories, malvertising and fake updates, running multiple activity clusters against industries like logistics and hospitality.

Country:

Not attributed

Malware-as-a-service / eCrime

First seen

2025

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

GrayBravo and TAG-150

GrayBravo is tracked under its own name and the Recorded Future designation TAG-150. It maps to one entry among the loader and MaaS operators we track, and its loader-and-delivery model overlaps with malware-as-a-service operations like SocGholish.

GROUP PROFILE

A CastleLoader-centered MaaS ecosystem

GrayBravo is a service operation that specializes in getting malware onto machines and keeping it there. Its CastleLoader and CastleRAT platform delivers whatever a client needs, from infostealers to backdoors, with strong anti-analysis and in-memory execution.

Our record ties it to a MaaS ecosystem centered on CastleLoader. Recorded Future detailed GrayBravo running four activity clusters targeting logistics and hospitality through phishing, ClickFix, malvertising and fake updates, with CastleRAT as a primary second-stage payload.

The group's tradecraft spans ClickFix and fake GitHub repos, fraudulently signed installers, Deno and Python loaders, and a multi-stage chain (stager, loader, core backdoor) delivering families like Lumma Stealer, RedLine, Rhadamanthys and NetSupport RAT.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

ClickFix lures into CastleLoader and CastleRAT

The stages below come from GrayBravo and TAG-150 activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

CastleLoader, CastleRAT and the delivery chain

Initial Access

CVES EXPLOITED

Social engineering, not CVE exploitation

GrayBravo gains access through ClickFix lures, fake GitHub repos, malvertising and fake updates rather than exploiting a consistent set of software vulnerabilities, so this profile does not list a confirmed exploited-CVE set tied to the group. Detection should focus on the ClickFix and fake-update lures, fraudulently signed installers, and the CastleLoader and CastleRAT chain.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

DinDoor, CastleLoader and CastleRAT

Recent reporting tracks the group's evolving tradecraft.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through