OTX Threat: Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

Arctic Wolf Labs has been tracking multiple campaigns built around CastleLoader, a multi-stage shellcode loader that has evolved significantly. Three distinct campaigns were identified: Urutyka, Garrigin, and Noidret. The most significant development is the integration of NeedleStealer framework payloads, marking the first observed use of Rust and Golang tooling in this campaign cluster. NeedleSte CVEs: CVE-2026-0257, CVE-2026-48558