--- title: Expanding the Castle: New Campaigns, New Tooling, and... description: Arctic Wolf Labs has tracked a cluster of CastleLoader campaigns and identified significant updates to the infection chain. Three campaigns (Urutyka, Garrigin,... canonical: https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection | daily.dev og:description: Arctic Wolf Labs has tracked a cluster of CastleLoader campaigns and identified significant updates to the infection chain. Three campaigns (Urutyka, Garrigin,... og:url: https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9 og:image: https://api.daily.dev/og/posts/5M93cI1J9.png og:image:alt: Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 12 min read · 0 upvotes · 0 comments ## Summary Arctic Wolf Labs has tracked a cluster of CastleLoader campaigns and identified significant updates to the infection chain. Three campaigns (Urutyka, Garrigin, Noidret) are documented, with the Noidret campaign being the most notable for introducing two new NeedleStealer payloads: a Rust-based desktop cryptocurrency wallet spoofer targeting Ledger, Trezor, and Exodus users via fake seed phrase prompts, and a Golang-based malicious browser extension installer enabling persistent session token and credential theft. These mark the first use of Rust and Golang tooling in this campaign cluster. The report also covers a new shellcode loader variant distributed via digitally signed installers using fraudulently obtained code-signing certificates, staged infrastructure domains, and detailed IOCs. Defensive recommendations include blocking known infrastructure, enforcing application allowlisting, monitoring PowerShell and IronPython activity, and restricting Node.js execution outside development environments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding](https://daily.dev/posts/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding-zkfrqypzs) · Security Boulevard · 0 upvotes · 0 comments - [New IronWorm malware hits 36 packages in npm supply-chain attack](https://daily.dev/posts/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack-2rfjqmxiq) · BleepingComputer · 62 upvotes · 21 comments - [Malicious GitHub Campaign: Fake “Arctic Wolf” and 290\+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer](https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql) · Arctic Wolf · 3 upvotes · 0 comments - [Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack](https://daily.dev/posts/web-shells-tunnels-and-ransomware-dissecting-a-warlock-attack-pabj8acyc) · Trend Micro · 0 upvotes · 0 comments - [Be alert: targeted attacks on prominent Rustaceans](https://daily.dev/posts/be-alert-targeted-attacks-on-prominent-rustaceans-ug8iw73la) · Tech Lead Digest · 0 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection","url":"https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9"},"datePublished":"2026-07-27T22:37:15.995Z","dateModified":"2026-07-27T22:37:41.836Z","description":"Arctic Wolf Labs has tracked a cluster of CastleLoader campaigns and identified significant updates to the infection chain. Three campaigns (Urutyka, Garrigin,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,rust,malware","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection"}]} ```