# SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations

> Zscaler ThreatLabz identified SloppyRAT, a new C++ remote access trojan delivered through a ClickFix chain (finger.exe fetching a batch script, IronPython, CastleLoader/CastleRAT staging) that gives ransomware-related operators a foothold for reconnaissance and lateral movement. It uses certificate pinning, encrypted code blocks, Hell's Gate indirect syscalls, reverse SOCKS and an unfinished EtherHiding (Polygon) C2 resolver, and appears to be under active development.

- **Published:** 2026-11-01T13:50:13Z
- **Last reviewed:** 2026-11-01T13:50:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4997
- **ID:** TL-2026-4997
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SloppyRAT was identified by Zscaler ThreatLabz in June 2026 and publicly documented on 2026-09-10. ThreatLabz assesses it is likely used by a ransomware-related threat actor to establish a foothold that enables reconnaissance and lateral movement; no specific actor or ransomware family is named.

Infection chain: a ClickFix lure convinces the victim to paste a caret-obfuscated cmd.exe one-liner that runs finger.exe against finger.linked4x.com (finger normally uses TCP/79). The finger response is a batch script that copies native curl.exe into the user's AppData\Local folder under a numeric name with a .com extension (for example 9342371634011778.com) and uses it to download IronPython 3.4.2 from GitHub (saved with a .pdf extension and extracted to %LOCALAPPDATA%\IronPython.3.4.2\net462, where the interpreter runs under a numeric .exe name such as 31706105999761.exe). IronPython executes zlib-compressed, Base64-encoded Python that downloads CastleLoader/CastleRAT components from skipraid.com (User-Agent K8VGmQTrzX). A second Python interpreter (pythonw.exe) fetches config.py from Azure Blob Storage (stro7121.blob.core.windows.net), which downloads hostfxr.dll (the SloppyRAT DLL, also hosted on an AWS S3 bucket) and reflectively loads it in memory (User-Agent Mozilla/5.0 (compatible; DLLMemLoader/1.0)).

C2 and capabilities: SloppyRAT speaks JSON over HTTPS (User-Agent CommandExecutor/1.0) to endpoints /api/auth, /api/systeminfo, /api/av_edr, /api/poll, /api/command/get, /api/command/result and /api/proxy/ack. It authenticates with a hardcoded X-API-Key header and a machine ID built from an FNV hash of volume and computer details, then uses a bearer session token (also sent as X-CSRF-Token on proxy connections). It pins the server certificate by SHA256 of the full DER certificate (defeating TLS inspection) and encrypts data with RC4 plus Base64 using a hardcoded key. The poll endpoint drives a reverse SOCKS proxy for lateral movement. Commands run via one of three paths: 47 built-in C++ re-implementations of PowerShell-style commands (whoami, Get-Process, Get-ChildItem, Get-LocalUser, Resolve-DnsName, Test-NetConnection, WMI/CIM queries, Net.WebClient DownloadFile, LNK creation and others), an in-process CLR PowerShell host (PSInline, output staged as XOR-encoded PNG-headed files in %TEMP%), or a PSSpoof fallback that launches powershell.exe with explorer.exe as spoofed parent via STARTUPINFOEX; cmd shell_type commands run through WMI Win32_Process::Create. It enumerates AV/EDR and can query or modify Microsoft Defender via Get-MpComputerStatus, Set-MpPreference and Add-MpPreference.

Evasion and development state: strings are protected by XOR stack strings (unique 4-byte key), single-byte XOR globals and an affine cipher (mod 127) for Polygon strings; 13 functions are encrypted at rest and decrypted at runtime with position-dependent XOR; junk code is inserted; APIs are resolved by DJB2 hash and called with Hell's Gate indirect syscalls (21 NTDLL functions resolved, 10 used). EtherHiding C2 resolution through Polygon JSON-RPC (contract selector 0xd6bd8727, LOADER_POLYGON_RESOLVER environment variable) is present but no contract address was observed. Both persistence methods (HKCU Run value named rundll32 and a COM InprocServer32 key keyed by an FNV-1a CLSID) are implemented incorrectly and non-functional in analyzed samples, indicating active development.

Context: the chain stages CastleLoader and CastleRAT, tooling associated with the TAG-150 malware-as-a-service operator (active since March 2025). Blackpoint SOC reported more than 60 incidents of a finger.exe ClickFix campaign delivering CastleLoader/CastleRAT between 2026-05-01 and 2026-07-02. Zscaler does not attribute SloppyRAT to TAG-150 or to any named ransomware group.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1059.006 Python
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1036.003 Rename Legitimate Utilities
- T1027.010 Command Obfuscation
- T1027.007 Dynamic API Resolution
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1134.004 Parent PID Spoofing
- T1685 Disable or Modify Tools
- T1547.001 Registry Run Keys / Startup Folder
- T1546.015 Component Object Model Hijacking
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1087.001 Local Account
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1132.001 Standard Encoding
- T1090 Proxy

## Sources

- [SloppyRAT: A New Tool For Ransomware Attacks (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks)
- [ClickFix Abuses Finger to Deliver CastleLoader (PacketWatch)](https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader)
- [CastleLoader adversary profile (ManageEngine)](https://www.manageengine.com/malware-protection/adversaries/castleloader.html)
- [Blackpoint SOC Threat Pulse: Week of July 6, 2026](https://blackpointcyber.com/blog/blackpoint-soc-threat-pulse-week-of-july-6-2026)
- [ClickFix BackgroundFix brief (CraftedSignal)](https://feed.craftedsignal.io/briefs/2026-04-clickfix-backgroundfix/)
- [IronPython 3.4.2 release (abused for payload execution)](https://github.com/IronLanguages/ironpython3/releases/tag/v3.4.2)
- [CastleLoader and CastleRAT: Behind TAG-150's Modular Malware Delivery System (Darktrace)](https://www.darktrace.com/blog/castleloader-castlerat-behind-tag150s-modular-malware-delivery-system)
- [TAG-150 Develops CastleRAT in Python (The Hacker News)](https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html)
- [Intelligence Insights: July 2026 (Red Canary)](https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4997