Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

A new Windows remote-access trojan dubbed SloppyRAT, which appears to be positioned as an intrusion-enablement tool for ransomware operations.

First observed in June 2026, the malware is delivered through a multi-stage ClickFix chain and combines host reconnaissance, stealthy command execution, reverse proxying, and resilient command-and-control mechanisms to support post-compromise activity and lateral movement.

Rather than immediately dropping a conventional executable, the command abuses the legacy Windows finger.exe utility to retrieve a batch script from an attacker-controlled server.

Finger typically communicates over TCP port 79, a protocol that is rarely necessary in modern enterprise environments, making its appearance in endpoint telemetry a potentially high-signal detection opportunity.

The downloaded script copies the legitimate Windows curl.exe binary into the user’s AppData directory, renames it with a numeric .com filename, and uses it to obtain IronPython from GitHub.

IronPython then launches a compressed and Base64-encoded Python payload, continuing the staged execution chain.

ThreatLabz linked subsequent activity to the download of CastleLoader and CastleRAT components from skipraid[.]com, using the distinctive K8VGmQTrzX User-Agent string.

CastleLoader has previously been associated with deceptive delivery campaigns and is designed to retrieve additional payloads, while CastleRAT provides remote control and command-execution functionality.

The final Python stage retrieves config.py from an Azure Blob Storage location and uses it to reflectively load SloppyRAT from a DLL named hostfxr.dll.

The loader uses the User-Agent string Mozilla/5.0 (compatible; DLLMemLoader/1.0), an indicator defenders can hunt for in proxy and cloud-storage logs.

SloppyRAT contains enough functionality to assist ransomware affiliates after initial access.

It can gather host and security-product information, enumerate processes, services, users, local-group membership, files, registry values, environment variables, and network connectivity.

It also supports downloading files, creating processes, running WMI queries, altering Microsoft Defender preferences, and launching commands through several execution paths.

Notably, the malware implements 47 PowerShell-like commands directly in C++ rather than invoking PowerShell for every task.

Commands resembling whoami, Get-Process, Get-Service, Get-LocalUser, Resolve-DnsName, Test-NetConnection, and Get-MpComputerStatus are mapped to native Windows APIs.

This approach reduces dependence on observable PowerShell activity while still giving operators a familiar command interface.

For arbitrary PowerShell, SloppyRAT can load the .NET CLR and invoke System.Management.Automation in-process through a handler internally called PSInline.

Zscaler said in a report shared with GBhackers, the campaign begins with a ClickFix lure that manipulates victims into running an obfuscated command.

SloppyRAT via ClickFix

If that fails, it falls back to spawning powershell.exe with a spoofed explorer.exe parent process, a technique intended to make process-tree inspection less revealing.

The Run registry value is set to execute rundll32.exe without specifying the necessary path to the SloppyRAT DLL and invoking the required export.

Its cmd mode executes commands through WMI’s Win32_Process::Create, creating yet another path for operators to blend into normal administrative activity.

The most operationally significant feature is SloppyRAT’s reverse SOCKS capability.

The malware can receive a proxy-related instruction from its /api/poll endpoint and establish a reverse SOCKS worker, enabling an operator to route traffic through the infected device into the internal network.

That capability can turn a single user-level foothold into a pivot point for reconnaissance and lateral movement.

An attacker could use the compromised endpoint to reach internal systems, identify file servers or administrative services, and move closer to high-value assets without exposing those systems directly to external infrastructure.

SloppyRAT attempts to complicate static and behavioral analysis through per-string XOR obfuscation, encrypted code routines, junk code, API hashing, and Hell’s Gate-style indirect system calls.

It resolves Windows Native API functions by DJB2 hash and invokes selected functions through direct syscalls, seeking to bypass user-mode security hooks.

Its HTTPS-based C2 protocol uses certificate pinning: the implant compares the server’s TLS certificate against a hardcoded SHA-256 value and terminates communication if it does not match.

This can prevent network-monitoring tools from inspecting traffic through TLS man-in-the-middle interception.

The malware also contains an EtherHiding fallback design for resolving C2 configuration through Polygon JSON-RPC infrastructure.

Although ThreatLabz did not find samples containing an active smart-contract address, the implementation could allow operators to shift C2 resolution to blockchain-hosted data, complicating conventional takedown and blocklist efforts.

SloppyRAT’s code includes flawed persistence logic and other implementation errors, suggesting the family remains under development.

However, its current capabilities are already sufficient for reconnaissance, proxying, command execution, and ransomware-adjacent intrusion activity.

Organizations should block outbound TCP/79 where possible, restrict or monitor finger.exe, investigate unexpected IronPython and Python runtime downloads, and alert on pythonw.exe launching scripts from user-writable directories.

Security teams should also hunt for the domains linked4x[.]com, skipraid[.]com, and the observed Azure Blob Storage paths; monitor requests using K8VGmQTrzX or DLLMemLoader/1.0; and treat ClickFix prompts asking users to paste commands into Run, PowerShell, Command Prompt, or Terminal as a high-risk social-engineering event.

Indicators Of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.