Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

Reported 28 Jul 2026 by otx · Severity: medium

Arctic Wolf Labs has been tracking multiple campaigns built around CastleLoader, a multi-stage shellcode loader that has evolved significantly. Three distinct campaigns were identified: Urutyka, Garrigin, and Noidret. The most significant development is the integration of NeedleS