Scworld CastleLoader Malware Expands Operations Targeting Logistics and Hospitality Sectors
Article Content
Browse articles 
GrayBravo, previously known as TAG-150, has expanded its CastleLoader malware deployment across four distinct threat activity clusters since March 2025. The malware targets industries such as logistics and hospitality, utilizing phishing and ClickFix tactics to compromise organizations, including impersonation of entities like Booking.com and DAT Freight.
Ask AI about this cluster
Answers cite the sources they use
Updated 217d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track Akira, AsyncRAT and DAT Freight & Analytics in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Chinese Smishing Gang Targets Ireland and Four Other EU Countries Ireland is identified as one of five EU countries targeted by the Chinese text-scam group known as Smishing Triad, as reported by the EU cyber security agency Enisa. This group conducts large-scale smishing operations, which involve sending fraudulent text messages that impersonate legitimate organizations to steal… 
Attackers Exploit MFA Gaps in SonicWall VPN Access On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment…