This week, Tanium’s Cyber Threat Intelligence (CTI) team looks at Shanya, a new packer-as-a-service (PaaS) that’s quickly spreading among ransomware groups. Next, the team investigates GrayBravo, a sophisticated threat actor that’s actively targeting industries like logistics and hospitality through phishing, malvertising, and fake software updates. Finally, we wrap up with an overview of Storm-0249’s recent pivot to exploiting endpoint detection and response (EDR) tools.
Shanya PaaS spreads among ransomware groups
Sophos is sharing details of Shanya, a new PaaS tool that appears to be replacing older services like HeartCrypt in the cybercriminal ecosystem.
Packer services are tools that encrypt or obfuscate malware to evade detection. Threat actors are now using Shanya to wrap ransomware in an obfuscation layer, helping it bypass anti-malware defenses.
Underground promotions
Near the end of 2024, Sophos discovered references in underground forums for an offering called VX Crypt. The offering was credited to “Shanya” even though the author’s ID was unrelated. However, the creator’s Telegram handle included “shanya.”
The post claims the offering had features for AMSI bypass, runtime protection, and sideloading. This packer’s features match those of another packer that Sophos observed, leading them to believe that it is the same PaaS.
In early samples, Sophos found executable and DLL names that used the string or a variant of “shanya.” They also observed instances in which an EDR killer and the CastleRAT malware both used malicious files that were created by the Shanya service.
Shanya has been observed across the globe throughout 2025.
The packed executables
Sophos analyzed a sample that is a variant of an EDR killer, which included a large amount of junk code but was ultimately determined to “build a decryptor and loader in a memory region, which would then decrypt the payload.”
- To start, Shanya builds a table holding key runtime details.
- The pointer to this table is hidden inside the Process Environment Block (PEB) at the GdiHandleBuffer field.
- From there, each stage of the malware can simply fetch the PEB to recover the pointer to the configuration table, creating a smaller footprint.
- Shanya can also dynamically resolve required Windows API functions and perform anti-analysis checks.
Notable use cases
According to Sophos, the Shanya-protected EDR killer has been used in DLL sideloading instances.
Sophos also notes that the EDR killer drops two kernel drivers including one that is legitimate but vulnerable and another that’s malicious and unsigned.
The report contains a long list of targeted services and processes. If one of these is found on the device, it is terminated.
Sophos also explains a real-world campaign that used Shanya, specifically to target hotels. This campaign is from September 2025 and was a ClickFix campaign that leveraged Booking.com.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Shanya PaaS formalizes the pipeline from EDR-killer to ransomware with its defense impairment. It’s essentially transforming sophisticated evasion into a subscription for actors looking to increase attack reliability.
In agreement with Sophos, this is not likely to go away anytime soon and will only continue to evolve.
GrayBravo expands its footprint
According to Recorded Future, GrayBravo (formerly TAG-150) operates under a likely malware-as-a-service model, deploying CastleLoader across multiple clusters targeting logistics and hospitality via phishing, malvertising, and fake software updates.
The group’s infrastructure and tooling demonstrate high adaptability, with advanced capabilities such as credential theft, remote access, and layered command-and-control (C2) systems.
Who is GrayBravo?
GrayBravo (formerly TAG-150) is a sophisticated threat actor that’s been active since at least March 2025. The actor is known for its rapid development capabilities and custom malware families, which include CastleLoader, CastleBot, and CastleRAT.
Recorded Future believes the group operates a malware-as-a-service (MaaS) ecosystem, leveraging multi-tiered infrastructure and advanced anti-detection techniques with four distinct activity clusters.
GrayBravo operates a complex, multi-tiered infrastructure to support its malware ecosystem. Tier 1 servers act as victim-facing command-and-control nodes for its malware families, while additional tiers provide layered functionality.
CastleRAT’s variants
Recorded Future’s report includes details about the CastleRAT malware, which has both a C and Python variant. Regardless of the variant, it’s capable of remote command execution, file download and execution, and establishing an interactive remote shell. The C variant comes with a few additional capabilities.
As far as the infrastructure goes, Recorded Future identified significant operational overlap across multiple nodes sharing the RC4 key “NanuchkaUpyachka.” They also identified a level of interconnectedness that potentially indicates a shared deployment framework for CastleRAT and CastleLoader.
Activity clusters
Recorded Future identified four activity clusters related to CastleLoader deployment:
- Cluster 1: The first cluster of activity, tracked by Recorded Future as TAG-160, is actively targeting the logistics sector. The cluster has been observed using the ClickFix technique to deploy CastleLoader and exploit vulnerabilities, while leveraging legitimate freight-matching platforms, including DAT Freight & Analytics and Loadlink Technologies.
- Cluster 2: Cluster 2 (TAG-161) is known to impersonate Booking.com. This group also uses the ClickFix technique to deploy CastleLoader and Matanbuchus.
- Cluster 3: This cluster also impersonates Booking.com, leverages ClickFix techniques, and uses Steam pages to deliver both CastleRAT and CastleLoader. At this point, Recorded Future hasn’t identified any technical overlaps between the second and third clusters.
- Cluster 4: The final cluster uses malvertising and fake software installers to deliver CastleLoader and NetSupport RAT. It relies on fake GitHub repos to distribute CastleLoader payloads, which are commonly delivered as electronically signed MSI installers.
Analyst comments from Tanium’s Cyber Threat Intelligence team
GrayBravo exemplifies the industrialization of cybercrime, where actors provide modular malware and infrastructure to affiliates.
CastleLoader’s role as a flexible delivery mechanism aligns with the broader shift from single-purpose malware to multi-stage loaders that enable ransomware, infostealers, and RATs.
The group’s use of multi-tiered and redundant C2 systems enables them to continue operating if one domain or IP is discovered and blocked.
Storm-0249 exploits EDR processes to hide malicious activity
According to ReliaQuest, the Storm-0249 initial access broker has transitioned from broad phishing campaigns to exploiting EDR tools. The group is using techniques like DLL sideloading and trusted process abuse to establish stealthy persistence.
This evolution enables ransomware affiliates to bypass traditional defenses and maintain long-term access while blending malicious activity into legitimate security operations.
Storm-0249’s new tactics
Storm-0249’s recent attacks begin via ClickFix. It’s also using various techniques including Microsoft domain spoofing and Curl-to-PowerShell piping, as well as DLL sideloading to target SentinelOne agents.
Once Storm-0249 gains access, the group will use curl.exe (a trusted tool among IT teams). The malicious script is hosted on a URL that mimics a Microsoft domain to trick users into thinking it is coming from a legitimate source.
Curl downloads malicious scripts from fake Microsoft domains, piping them into PowerShell memory to evade signature-based detection. As ReliaQuest points out, “by running entirely in memory, traditional signature-based detections miss the activity entirely.”
Turning security software against itself
According to ReliaQuest, Storm-0249 has demonstrated the ability to load their malicious code by manipulating a legitimate SentinelOne executable.
In this attack, the user must be tricked into running a malicious MSI package that they download from the fake Microsoft site. The downloaded package requires system privileges, which gives the actor what they need to execute the true malicious code.
The MSI package includes a DLL that pretends to be a SentinelOne EDR component and drops this to the user’s AppData folder. With the help of DLL sideloading, the malicious DLL is loaded when SentinelOne is launched instead of the legitimate DLL.
Disguised communication channels
In addition to updating some of their tactics, the group has also changed its C2 communication approach.
The malware would previously establish direct C2 communications, which created outbound traffic and were easy to discover. Now, the group is abusing trusted pieces of SentinelOne’s software to establish their C2 communication, which ReliaQuest highlights is concerning because it occurs in whitelisted software.
Disguised reconnaissance
ReliaQuest also observed the actor engaging in reconnaissance activity by using legitimate Windows utilities that are “nearly impossible to block without disrupting IT operations.”
Once the SentinelAgentWorker.exe executable was compromised, the actor was able to execute reg.exe and other commands to obtain system identifiers. ReliaQuest notes that this could be done in preparation for ransomware affiliates.
Analyst comments from Tanium’s Cyber Threat Intelligence team
As this example demonstrates, attackers are increasingly weaponizing trusted security tools to evade detection.
The abuse of legitimate EDR processes highlights how trust in software can become a liability and how supply chain style attacks are getting more creative. This is yet another example of the need for behavioral analytics over signature-based defenses.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.