# SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks

> SloppyRAT is a newly identified Windows remote access trojan, first observed by Zscaler ThreatLabz in June 2026, delivered via a ClickFix lure that abuses the legacy finger.exe/Finger-protocol (TCP/79) LOLBin as its initial download channel. It supports 47 emulated PowerShell-like commands, a reverse SOCKS proxy for internal lateral movement, Hell's Gate indirect-syscall evasion, and an EtherHiding fallback C2 channel resolved via the Polygon blockchain JSON-RPC protocol; Zscaler assesses it is likely leveraged by a ransomware-related threat actor for initial foothold and lateral movement.

- **Published:** 2026-09-10T00:00:00Z
- **Last reviewed:** 2026-09-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2439
- **ID:** TL-2026-2439
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SloppyRAT arrives at the end of a multi-stage delivery chain that begins with a ClickFix-style social-engineering lure instructing the victim to run a command that invokes finger.exe against the attacker-controlled server finger.linked4x[.]com over TCP/79. The Finger response is an obfuscated batch script (caret-escaped cmd.exe invocation) that copies Windows' native curl.exe into %AppData% under a numeric filename with a .com extension, then uses it to download IronPython from GitHub. The IronPython interpreter is renamed to masquerade as a PDF and used to execute zlib-compressed, Base64-encoded Python code that retrieves and runs CastleLoader, which in turn deploys CastleRAT before finally dropping SloppyRAT (delivered as a DLL disguised as hostfxr.dll, staged on both an Azure Blob Storage account and an AWS S3 bucket as a fallback host).

Once resident, SloppyRAT implements 47 built-in commands that are native C++ re-implementations of common PowerShell/cmd cmdlets and aliases (not an embedded PowerShell engine) spanning system/user enumeration (whoami, hostname, Get-ComputerInfo, Get-LocalUser, Get-LocalGroupMember), file and directory operations (ls, dir, Get-ChildItem, New-Item, Remove-Item), process and service management (Get-Process, tasklist, Get-Service, Start-Process), networking checks (Test-NetConnection, Resolve-DnsName), and Defender queries/tampering (Get-MpComputerStatus, Set-MpPreference, Add-MpPreference). It also implements a reverse SOCKS proxy: the C2 issues open/close actions with a request_id over a polling /api/poll endpoint, and the implant confirms readiness via /api/proxy/ack, letting the operator pivot through the infected host for internal reconnaissance and lateral movement toward eventual ransomware deployment.

C2 communication is HTTPS with JSON payloads, authenticated via a hardcoded X-API-Key header, with a per-host machine ID derived from an FNV hash of the volume serial number, volume label, filesystem name, and computer name. TLS certificate pinning (hash comparison against an expected SHA256) is used to detect and abort on interception/MITM inspection. As a takedown-resistant fallback, SloppyRAT can retrieve C2 location data from the Polygon blockchain via JSON-RPC (observed smart-contract function selector 0xd6bd8727); Zscaler notes the actual contract address was not recovered from analyzed samples and this EtherHiding capability may still be under active development.

Defense evasion centers on a Hell's Gate-style indirect/direct syscall implementation: SloppyRAT resolves roughly 21 Windows API functions via a DJB2 hash of their names, reads the corresponding NTDLL stub, locates the 0xB8 (mov eax) opcode, extracts the syscall number from the following 4 bytes, and issues the syscall directly — bypassing userland API hooks placed by EDR/AV. Ten of these resolved functions (including NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory, NtCreateFile, and NtOpenProcess) are observed in active use. Additional obfuscation layers include stack-based XOR with unique 4-byte keys, single-byte global XOR, an affine cipher (modulus 127) reserved for the Polygon-resolver strings, 13 functions whose code bodies are decrypted at runtime via a positional XOR formula, and substantial junk-code insertion to frustrate static analysis.

Notably, the malware's two persistence mechanisms both appear to be broken as implemented: a Registry Run Key write under HKCU\Software\Microsoft\Windows\CurrentVersion\Run (name 'rundll32') omits the required DLL path and export, and a COM-hijacking routine builds a new CLSID (via an FNV-1a hash of the computer name) under HKLM\...\CLSID\{clsid}\InprocServer32 rather than hijacking an existing one — defeating the purpose of COM hijacking. Zscaler explicitly characterizes both as incorrectly implemented, which is consistent with the 'sloppy' naming.

Attribution caveat: Zscaler does not name a specific threat actor or group for SloppyRAT, describing it only as likely used by 'a ransomware-related threat actor.' The preceding stages of the delivery chain (CastleLoader, CastleRAT) are well-documented tools developed and operated by the group Recorded Future's Insikt Group tracks as GrayBravo (formerly TAG-150), a malware-as-a-service operator active since at least March 2025 known for rapid development cycles and an expansive multi-tiered infrastructure — but no source reviewed for this research formally attributes SloppyRAT itself to that group, so threat_actor is recorded as Unknown pending further correlation.

## MITRE ATT&CK

- T1204 User Execution
- T1106 Native API
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1090 Proxy
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1007 System Service Discovery
- T1087 Account Discovery
- T1518 Software Discovery
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution

## Sources

- [SloppyRAT: A New Tool For Ransomware Attacks](https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks)
- [SloppyRAT: A New Tool For Ransomware Attacks (syndication)](https://malware.news/t/sloppyrat-a-new-tool-for-ransomware-attacks/125506)
- [TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations](https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html)
- [CastleLoader Malware Infects 469 Devices Using Fake GitHub Repos and ClickFix Phishing](https://thehackernews.com/2025/07/castleloader-malware-infects-469.html)
- [Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure](https://thehackernews.com/2025/12/four-threat-clusters-using-castleloader.html)
- [From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure](https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations)
- [GrayBravo's CastleLoader Activity Clusters Target Multiple Industries](https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries)
- [Decades-old 'Finger' protocol abused in ClickFix malware attacks](https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2439