SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks

Key facts for SloppyRAT finger.exe RAT

Detection coverage for SloppyRAT finger.exe RAT

As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2439 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SloppyRAT HTTPS C2 Beaconing, Reverse SOCKS Proxy & EtherHiding Polygon Fallback — C2/Lateral Movement

Detects SloppyRAT's primary HTTPS/JSON C2 channel (X-API-Key authenticated /api/poll and /api/proxy/ack check-ins to api.telephoneip[.]net, api.truesmart[.]org, and 62.106.66[.]148:443) that drives its reverse SOCKS proxy for internal lateral movement, plus outbound calls to public blockchain JSON-RPC providers (observed function selector 0xd6bd8727) consistent with the EtherHiding fallback that resolves C2 location data via the Polygon blockchain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071, T1573, T1008, T1090, T1562
• Data sources: proxy_logs, firewall_logs, dns_logs, sysmon
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=firewall OR index=dns
| eval dest_domain=coalesce(dest_domain, query, DestinationHostname)
| search (dest_domain="api.telephoneip.net" OR dest_domain="api.truesmart.org" OR dest_ip="62.106.66.148")
    OR (uri_path="/api/poll" OR uri_path="/api/proxy/ack")
    OR (dest_domain="*polygon-rpc*" OR dest_domain="*.matic*" OR http_content="*0xd6bd8727*")
| eval c2_flag=case(
    match(dest_domain,"telephoneip|truesmart") OR dest_ip="62.106.66.148", "SloppyRAT primary/fallback HTTPS C2 (X-API-Key authenticated)",
    match(uri_path,"api.poll|api.proxy.ack"), "SloppyRAT reverse SOCKS proxy poll/ack endpoint",
    match(http_content,"0xd6bd8727") OR match(dest_domain,"polygon-rpc|matic"), "Suspected EtherHiding Polygon JSON-RPC C2 fallback lookup")
| table _time, src_ip, dest_ip, dest_domain, uri_path, http_method, dest_port, c2_flag
| sort - _time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("api.telephoneip.net", "api.truesmart.org") or RemoteIP == "62.106.66.148"
    or RemoteUrl has_any ("/api/poll", "/api/proxy/ack")
| extend C2Flag = "SloppyRAT C2 / reverse-SOCKS-proxy beacon"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, C2Flag
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("polygon-rpc.com", "matic-mainnet", "alchemyapi.io/v2", "infura.io/v3")
    | where InitiatingProcessFileName !in ("chrome.exe","msedge.exe","firefox.exe","metamask.exe","brave.exe")
    | extend C2Flag = "Suspected EtherHiding Polygon JSON-RPC C2 fallback lookup from non-Web3 process"
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, C2Flag
)
| order by Timestamp desc

Sigma

title: SloppyRAT HTTPS C2 Beaconing and EtherHiding Polygon RPC Fallback
id: 3c4d5e6f-7081-4a92-8b3c-4d5e6f708192
status: experimental
description: Detects network connections to known SloppyRAT command-and-control infrastructure (X-API-Key authenticated HTTPS/JSON C2 with reverse-SOCKS-proxy poll/ack endpoints), and outbound traffic to public blockchain JSON-RPC providers from non-Web3 hosts consistent with the malware's EtherHiding fallback resolution over the Polygon blockchain.
references:
    - https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026/09/10
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573.002
    - attack.t1008
    - attack.t1090.002
    - attack.defense_evasion
    - attack.t1562.001
    - attack.malware.sloppyrat
logsource:
    category: network_connection
    product: windows
detection:
    sel_c2_domain:
        DestinationHostname|contains:
            - 'api.telephoneip.net'
            - 'api.truesmart.org'
    sel_c2_ip:
        DestinationIp: '62.106.66.148'
        DestinationPort: 443
    sel_rpc_fallback:
        DestinationHostname|contains:
            - 'polygon-rpc.com'
            - 'matic-mainnet'
    filter_web3_process:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\metamask.exe'
    condition: sel_c2_domain or sel_c2_ip or (sel_rpc_fallback and not filter_web3_process)
falsepositives:
    - Legitimate outbound connections to blockchain RPC providers from Web3/crypto development, trading, or wallet workstations
    - Historical/expired IP reassignment temporarily resolving unrelated legitimate traffic to a previously flagged C2 IP
level: critical

Known false positives:

• Legitimate outbound connections to blockchain RPC providers from Web3/crypto development, trading, or wallet workstations
• Temporary IP reassignment/CDN churn resolving unrelated legitimate traffic to a previously flagged C2 IP after infrastructure takedown

Tuning notes: Maintain an allow-list of approved blockchain RPC endpoints for any legitimate Web3 business unit before enabling the EtherHiding branch broadly; the specific C2 domains/IP should be expired on a rotation schedule, so pivot to JA3/JA4 TLS-client fingerprinting or the X-API-Key header pattern for durability against C2 domain rotation.

• 🔒 Finger Protocol (TCP/79) ClickFix Delivery Channel — Exploitation · unlock with TL Creds
• 🔒 IronPython PDF Masquerade, hostfxr.dll Side-Load & Broken SloppyRAT Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 SloppyRAT HTTPS C2 Beaconing, Reverse SOCKS Proxy & EtherHiding Polygon Fallback — C2/Lateral Movement · unlock with TL Creds
• 🔒 Finger Protocol (TCP/79) ClickFix Delivery Channel — Exploitation · unlock with TL Creds
• 🔒 IronPython PDF Masquerade, hostfxr.dll Side-Load & Broken SloppyRAT Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 SloppyRAT HTTPS C2 Beaconing, Reverse SOCKS Proxy & EtherHiding Polygon Fallback — C2/Lateral Movement · unlock with TL Creds
• 🔒 Finger Protocol (TCP/79) ClickFix Delivery Channel — Exploitation · unlock with TL Creds
• 🔒 IronPython PDF Masquerade, hostfxr.dll Side-Load & Broken SloppyRAT Persistence — Post-Exploitation · unlock with TL Creds

Indicators of compromise for SloppyRAT finger.exe RAT

As of 2026-09-10, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2439.

Sample indicators (3 of 30)

• IP address: 62.106.66[.]148
• Domain: finger[.]linked4x[.]com
• File hash: 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How SloppyRAT finger.exe RAT works

It supports 47 emulated PowerShell-like commands, a reverse SOCKS proxy for internal lateral movement, Hell's Gate indirect-syscall evasion, and an EtherHiding fallback C2 channel resolved via the Polygon blockchain JSON-RPC protocol; Zscaler assesses it is likely leveraged by a ransomware-related threat actor for initial foothold and lateral movement.

SloppyRAT arrives at the end of a multi-stage delivery chain that begins with a ClickFix-style social-engineering lure instructing the victim to run a command that invokes finger.exe against the attacker-controlled server finger.linked4x[.]com over TCP/79. The Finger response is an obfuscated batch script (caret-escaped cmd.exe invocation) that copies Windows' native curl.exe into %AppData% under a numeric filename with a .com extension, then uses it to download IronPython from GitHub. The IronPython interpreter is renamed to masquerade as a PDF and used to execute zlib-compressed, Base64-encoded Python code that retrieves and runs CastleLoader, which in turn deploys CastleRAT before finally dropping SloppyRAT (delivered as a DLL disguised as hostfxr.dll, staged on both an Azure Blob Storage account and an AWS S3 bucket as a fallback host).

Once resident, SloppyRAT implements 47 built-in commands that are native C++ re-implementations of common PowerShell/cmd cmdlets and aliases (not an embedded PowerShell engine) spanning system/user enumeration (whoami, hostname, Get-ComputerInfo, Get-LocalUser, Get-LocalGroupMember), file and directory operations (ls, dir, Get-ChildItem, New-Item, Remove-Item), process and service management (Get-Process, tasklist, Get-Service, Start-Process), networking checks (Test-NetConnection, Resolve-DnsName), and Defender queries/tampering (Get-MpComputerStatus, Set-MpPreference, Add-MpPreference). It also implements a reverse SOCKS proxy: the C2 issues open/close actions with a request_id over a polling /api/poll endpoint, and the implant confirms readiness via /api/proxy/ack, letting the operator pivot through the infected host for internal reconnaissance and lateral movement toward eventual ransomware deployment.

C2 communication is HTTPS with JSON payloads, authenticated via a hardcoded X-API-Key header, with a per-host machine ID derived from an FNV hash of the volume serial number, volume label, filesystem name, and computer name. TLS certificate pinning (hash comparison against an expected SHA256) is used to detect and abort on interception/MITM inspection. As a takedown-resistant fallback, SloppyRAT can retrieve C2 location data from the Polygon blockchain via JSON-RPC (observed smart-contract function selector 0xd6bd8727); Zscaler notes the actual contract address was not recovered from analyzed samples and this EtherHiding capability may still be under active development.

Defense evasion centers on a Hell's Gate-style indirect/direct syscall implementation: SloppyRAT resolves roughly 21 Windows API functions via a DJB2 hash of their names, reads the corresponding NTDLL stub, locates the 0xB8 (mov eax) opcode, extracts the syscall number from the following 4 bytes, and issues the syscall directly — bypassing userland API hooks placed by EDR/AV. Ten of these resolved functions (including NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory, NtCreateFile, and NtOpenProcess) are observed in active use. Additional obfuscation layers include stack-based XOR with unique 4-byte keys, single-byte global XOR, an affine cipher (modulus 127) reserved for the Polygon-resolver strings, 13 functions whose code bodies are decrypted at runtime via a positional XOR formula, and substantial junk-code insertion to frustrate static analysis.

Notably, the malware's two persistence mechanisms both appear to be broken as implemented: a Registry Run Key write under HKCU\Software\Microsoft\Windows\CurrentVersion\Run (name 'rundll32') omits the required DLL path and export, and a COM-hijacking routine builds a new CLSID (via an FNV-1a hash of the computer name) under HKLM\...\CLSID\{clsid}\InprocServer32 rather than hijacking an existing one — defeating the purpose of COM hijacking. Zscaler explicitly characterizes both as incorrectly implemented, which is consistent with the 'sloppy' naming.

Attribution caveat: Zscaler does not name a specific threat actor or group for SloppyRAT, describing it only as likely used by 'a ransomware-related threat actor.' The preceding stages of the delivery chain (CastleLoader, CastleRAT) are well-documented tools developed and operated by the group Recorded Future's Insikt Group tracks as GrayBravo (formerly TAG-150), a malware-as-a-service operator active since at least March 2025 known for rapid development cycles and an expansive multi-tiered infrastructure — but no source reviewed for this research formally attributes SloppyRAT itself to that group, so threat_actor is recorded as Unknown pending further correlation.

MITRE ATT&CK techniques by tactic:

Discovery

T1007 System Service Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Execution

T1106 Native API; T1204 User Execution

Persistence

T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution

defense-impairment

T1685 Disable or Modify Tools

Remediation for SloppyRAT finger.exe RAT

Immediate actions

• Block or restrict outbound TCP/79 (Finger protocol) traffic and disable the Windows Finger client (finger.exe) via feature removal or application control, since it has no legitimate modern business use.
• Block known SloppyRAT and delivery-chain C2/hosting indicators at perimeter and DNS: 62.106.66[.]148:443, api.telephoneip[.]net, api.truesmart[.]org, finger.linked4x[.]com, skipraid[.]com, stro7121.blob.core.windows[.]net, backup-ubt.s3.us-east-1.amazonaws[.]com.
• Hunt for curl.exe copied into %AppData% under a short numeric filename with a .com extension, and for IronPython binaries renamed to mimic PDF files — both are distinctive early-stage artifacts of this chain.

Workarounds

• Disable the Finger client feature or block TCP/79 egress at host firewall/network edge; no legitimate workflow in a modern enterprise depends on it.
• Enable PowerShell/cmd constrained language mode and script block logging so the emulated 47-command set (whoami/Get-Process/Get-Service/Get-MpComputerStatus, etc.) generates visible telemetry even though SloppyRAT does not use the real PowerShell engine.

Longer-term hardening

• Deploy EDR/behavioral detection capable of flagging direct or indirect NT syscalls (Hell's Gate-style API-hook bypass) rather than relying solely on userland API hooking for telemetry.
• Monitor and alert on host egress to public blockchain JSON-RPC endpoints (e.g., Polygon RPC providers) from non-Web3 business hosts as a potential EtherHiding C2 fallback indicator.
• Restrict and log legacy LOLBins (finger.exe, IronPython/ipy.exe) via application control policy, since none are expected in a standard enterprise Windows fleet.

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11; Windows Server (supported versions with TCP/IP and the Finger client available)

Timeline of SloppyRAT finger.exe RAT

• 2025-03-01 TAG-150 (later tracked as GrayBravo by Recorded Future's Insikt Group) becomes active, initially deploying the CastleLoader malware family; exact date not specified beyond March 2025 in public reporting.
• 2025-07-01 The Hacker News reports a CastleLoader campaign that infected 469 devices via fake GitHub repositories and ClickFix phishing lures.
• 2025-09-01 TAG-150/GrayBravo develops CastleRAT in both Python and C variants, expanding CastleLoader malware operations, per Recorded Future and The Hacker News reporting.
• 2025-11-16 BleepingComputer documents ClickFix campaigns abusing the decades-old Finger protocol (finger.exe, TCP/79) as a covert delivery channel for CastleLoader.
• 2025-12-01 The Hacker News reports four distinct threat clusters using CastleLoader as GrayBravo expands its malware-as-a-service infrastructure.
• 2026-06-01 Zscaler ThreatLabz first observes SloppyRAT in the wild as the final payload delivered via the CastleLoader/CastleRAT chain.
• 2026-09-10 The analysis is syndicated to Malware News by contributor MalBot, corroborating Zscaler's findings without adding new threat-actor attribution.
• 2026-09-10 Zscaler ThreatLabz publishes 'SloppyRAT: A New Tool For Ransomware Attacks,' detailing the finger.exe/ClickFix delivery chain, 47 built-in commands, reverse SOCKS proxy, EtherHiding/Polygon C2 resilience, and Hell's Gate syscall evasion.

Sources cited for SloppyRAT finger.exe RAT

• From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure Recorded Future · Research · 2025-09-01
• GrayBravo's CastleLoader Activity Clusters Target Multiple Industries Recorded Future · Research · 2025-12-01
• User Execution: Malicious Copy and Paste, Sub-technique T1204.004 MITRE · Research · 2025-03-18
• SloppyRAT: A New Tool For Ransomware Attacks zscaler.com · Blog · 2026-09-10
• SloppyRAT: A New Tool For Ransomware Attacks (syndication) malware.news · Blog · 2026-09-10
• TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations The Hacker News · News · 2025-09-01
• CastleLoader Malware Infects 469 Devices Using Fake GitHub Repos and ClickFix Phishing The Hacker News · News · 2025-07-01
• Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure The Hacker News · News · 2025-12-01
• Decades-old 'Finger' protocol abused in ClickFix malware attacks BleepingComputer · News · 2025-11-16

More in malware

• CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
• Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)
• SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations
• QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service
• APT37 NarwhalRAT: MS-Themed Phishing and pCloud Dead-drop C2 Targeting Korean Users