Threat reportMalwareTL-2026-4997
SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations
SloppyRAT: New ClickFix-Delivered Remote Access Trojan (TL-2026-4997) is a high-severity malware campaign, first published 2026-11-01. It has no confirmed attribution, affects Microsoft Windows, maps to 25 MITRE ATT&CK techniques (T1027.007, T1027.010, T1027.013), and is covered by 9 detection rules and 40 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 40Indicators of compromise
Key facts for TL-2026-4997
- Threat ID
- TL-2026-4997
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all sectors
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in SloppyRAT: New ClickFix-Delivered Remote Access Trojan
Malware and tooling: CASTLELOADER, NightshadeC2 (Windows), SloppyRAT, IronPython
How SloppyRAT: New ClickFix-Delivered Remote Access Trojan works
Zscaler ThreatLabz identified SloppyRAT, a new C++ remote access trojan delivered through a ClickFix chain (finger.exe fetching a batch script, IronPython, CastleLoader/CastleRAT staging) that gives ransomware-related operators a foothold for reconnaissance and lateral movement. It uses certificate pinning, encrypted code blocks, Hell's Gate indirect syscalls, reverse SOCKS and an unfinished EtherHiding (Polygon) C2 resolver, and appears to be under active development.
SloppyRAT was identified by Zscaler ThreatLabz in June 2026 and publicly documented on 2026-09-10. ThreatLabz assesses it is likely used by a ransomware-related threat actor to establish a foothold that enables reconnaissance and lateral movement; no specific actor or ransomware family is named.
Infection chain: a ClickFix lure convinces the victim to paste a caret-obfuscated cmd.exe one-liner that runs finger.exe against finger.linked4x.com (finger normally uses TCP/79). The finger response is a batch script that copies native curl.exe into the user's AppData\Local folder under a numeric name with a .com extension (for example 9342371634011778.com) and uses it to download IronPython 3.4.2 from GitHub (saved with a .pdf extension and extracted to %LOCALAPPDATA%\IronPython.3.4.2\net462, where the interpreter runs under a numeric .exe name such as 31706105999761.exe). IronPython executes zlib-compressed, Base64-encoded Python that downloads CastleLoader/CastleRAT components from skipraid.com (User-Agent K8VGmQTrzX). A second Python interpreter (pythonw.exe) fetches config.py from Azure Blob Storage (stro7121.blob.core.windows.net), which downloads hostfxr.dll (the SloppyRAT DLL, also hosted on an AWS S3 bucket) and reflectively loads it in memory (User-Agent Mozilla/5.0 (compatible; DLLMemLoader/1.0)).
C2 and capabilities: SloppyRAT speaks JSON over HTTPS (User-Agent CommandExecutor/1.0) to endpoints /api/auth, /api/systeminfo, /api/av_edr, /api/poll, /api/command/get, /api/command/result and /api/proxy/ack. It authenticates with a hardcoded X-API-Key header and a machine ID built from an FNV hash of volume and computer details, then uses a bearer session token (also sent as X-CSRF-Token on proxy connections). It pins the server certificate by SHA256 of the full DER certificate (defeating TLS inspection) and encrypts data with RC4 plus Base64 using a hardcoded key. The poll endpoint drives a reverse SOCKS proxy for lateral movement. Commands run via one of three paths: 47 built-in C++ re-implementations of PowerShell-style commands (whoami, Get-Process, Get-ChildItem, Get-LocalUser, Resolve-DnsName, Test-NetConnection, WMI/CIM queries, Net.WebClient DownloadFile, LNK creation and others), an in-process CLR PowerShell host (PSInline, output staged as XOR-encoded PNG-headed files in %TEMP%), or a PSSpoof fallback that launches powershell.exe with explorer.exe as spoofed parent via STARTUPINFOEX; cmd shell_type commands run through WMI Win32_Process::Create. It enumerates AV/EDR and can query or modify Microsoft Defender via Get-MpComputerStatus, Set-MpPreference and Add-MpPreference.
Evasion and development state: strings are protected by XOR stack strings (unique 4-byte key), single-byte XOR globals and an affine cipher (mod 127) for Polygon strings; 13 functions are encrypted at rest and decrypted at runtime with position-dependent XOR; junk code is inserted; APIs are resolved by DJB2 hash and called with Hell's Gate indirect syscalls (21 NTDLL functions resolved, 10 used). EtherHiding C2 resolution through Polygon JSON-RPC (contract selector 0xd6bd8727, LOADER_POLYGON_RESOLVER environment variable) is present but no contract address was observed. Both persistence methods (HKCU Run value named rundll32 and a COM InprocServer32 key keyed by an FNV-1a CLSID) are implemented incorrectly and non-functional in analyzed samples, indicating active development.
Context: the chain stages CastleLoader and CastleRAT, tooling associated with the TAG-150 malware-as-a-service operator (active since March 2025). Blackpoint SOC reported more than 60 incidents of a finger.exe ClickFix campaign delivering CastleLoader/CastleRAT between 2026-05-01 and 2026-07-02. Zscaler does not attribute SloppyRAT to TAG-150 or to any named ransomware group.
MITRE ATT&CK techniques used in TL-2026-4997
Defense Evasion
T1027.007 Dynamic API Resolution; T1027.010 Command Obfuscation; T1027.013 Encrypted/Encoded File; T1036.003 Rename Legitimate Utilities; T1134.004 Parent PID Spoofing; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087.001 Local Account; T1518.001 Security Software Discovery
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python; T1106 Native API; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
Persistence
T1546.015 Component Object Model Hijacking; T1547.001 Registry Run Keys / Startup Folder
defense-impairment
Affected products and versions in SloppyRAT: New ClickFix-Delivered Remote Access Trojan
- Microsoft — Windows
Vulnerable versions: Windows endpoints with finger.exe and curl.exe present
Remediation for SloppyRAT: New ClickFix-Delivered Remote Access Trojan
Immediate actions
- Block outbound TCP/79 (finger) at the perimeter and alert on any finger.exe execution
- Block and hunt for finger.linked4x.com, skipraid.com, api.telephoneip.net, api.truesmart.org, stro7121.blob.core.windows.net, backup-ubt.s3.us-east-1.amazonaws.com and 62.106.66.148
- Hunt for curl.exe copies renamed to numeric .com files in %LOCALAPPDATA% and IronPython.3.4.2.pdf/zip artifacts
- Hunt for HTTP User-Agents CommandExecutor/1.0, DLLMemLoader/1.0 and K8VGmQTrzX
- Isolate hosts where pythonw.exe or ipy.exe loads config.py or hostfxr.dll from a user-writable path
Workarounds
- Disable or remove finger.exe via application control (AppLocker/WDAC) where not required
- Restrict egress to unsanctioned Azure Blob Storage and S3 buckets for unmanaged endpoints
Longer-term hardening
- Train users to recognize ClickFix (paste-and-run) lures and restrict the Win+R / terminal paste workflow where feasible
- Deploy EDR with behavioral detection for indirect syscalls, PPID spoofing and reflective DLL loading
- Alert on Python/IronPython interpreters running from user profile directories
- Monitor for Set-MpPreference/Add-MpPreference tampering with Microsoft Defender
Timeline of SloppyRAT: New ClickFix-Delivered Remote Access Trojan
- TAG-150, the malware-as-a-service operator associated with CastleLoader and CastleRAT, is reported active since March 2025 (exact day not stated).
- Darktrace detects CastleLoader/CastleRAT activity on a US-based customer network (C2 173.44.141.89, URIs /service/download/data_5x.bin and data_6x.bin).
- Public reporting (The Hacker News, September 2025) documents TAG-150 developing a Python-based CastleRAT variant (PyNightshade); exact day not stated.
- ClickFix BackgroundFix variant disclosed in April 2026 (CraftedSignal brief); exact day not stated.
- Blackpoint SOC begins counting incidents of a finger.exe ClickFix campaign delivering CastleLoader and CastleRAT (more than 60 incidents between 2026-05-01 and 2026-07-02).
- Zscaler ThreatLabz identifies SloppyRAT in June 2026 within a multi-stage ClickFix chain (exact day not stated).
- End of the Blackpoint observation window for the 60+ finger.exe ClickFix incidents; reported in the Threat Pulse for the week of 2026-07-06.
- Analysis notes the Polygon EtherHiding resolver (selector 0xd6bd8727) has no observed contract address and both persistence methods are non-functional, indicating active development.
- Zscaler ThreatLabz publishes 'SloppyRAT: A New Tool For Ransomware Attacks' with full technical analysis and IOCs.
Sources cited for SloppyRAT: New ClickFix-Delivered Remote Access Trojan
- SloppyRAT: A New Tool For Ransomware Attacks (Zscaler ThreatLabz)
- ClickFix Abuses Finger to Deliver CastleLoader (PacketWatch)
- CastleLoader adversary profile (ManageEngine)
- Blackpoint SOC Threat Pulse: Week of July 6, 2026
- ClickFix BackgroundFix brief (CraftedSignal)
- IronPython 3.4.2 release (abused for payload execution)
- CastleLoader and CastleRAT: Behind TAG-150's Modular Malware Delivery System (Darktrace)
- TAG-150 Develops CastleRAT in Python (The Hacker News)
- Intelligence Insights: July 2026 (Red Canary)
Detection coverage for TL-2026-4997
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4997 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.