GrayBravo

Reports per quarter

Techniques seen in the last two years

• T1005 1 report
• T1036 1 report
• T1059.001 1 report
• T1059.010 1 report
• T1071.001 1 report
• T1090.002 1 report
• T1105 1 report
• T1189 1 report
• T1204.002 1 report
• T1204.004 1 report

Counts come from technique IDs in the actor's report text.

Reports

1. 2 February 2026

   CastleLoader: Malware Overview

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor CastleLoader: Malware Overview

2. 9 December 2025

   GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries

3. 4 September 2025

   From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure

Newest first. Details opens the report in Explore.