Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler ThreatLabz reports SloppyRAT, a new Windows RAT delivered via ClickFix lures that supports reconnaissance, reverse SOCKS proxying, and lateral movement for ransomware affiliates.
Zscaler ThreatLabz first observed SloppyRAT in June 2026, delivered through multi-stage ClickFix chains that abuse finger.exe, a renamed curl.exe, and IronPython to load a reflective Python payload. The C++ implant implements 47 PowerShell-like commands via native APIs and direct syscalls, modifies Microsoft Defender settings, and establishes a reverse SOCKS proxy that lets operators pivot into internal networks. It is linked to CastleLoader and CastleRAT components and uses certificate-pinned HTTPS C2 with an EtherHiding fallback via Polygon JSON-RPC. Zscaler assesses it as an intrusion-enablement tool for ransomware operations, though flawed persistence logic suggests the family is still under development.
- Delivered via ClickFix lures abusing finger.exe on TCP/79 and a renamed curl.exe in AppData
- Downloads IronPython from GitHub; final stage loads SloppyRAT from hostfxr.dll via Azure Blob Storage
- Implements 47 PowerShell-like commands in C++ with native APIs and Hell's Gate-style direct syscalls
- Reverse SOCKS proxying and WMI execution enable pivoting toward file servers and high-value assets
- Hunt linked4x.com, skipraid.com, K8VGmQTrzX and DLLMemLoader/1.0 user-agent indicators
- ATT&CK
- T1204.001 Malicious LinkT1105 Ingress Tool TransferT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair Defenses: Disable or Modify ToolsT1090.001 Internal Proxy
- Products
- Microsoft Defender
- Organizations
- Zscaler ThreatLabz
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | linked4x.com | irectories. Security teams should also hunt for the domains linked4x[.]com , skipraid[.]com , and the observed Azure Blob Storage pa |
| domain | skipraid.com | the download of CastleLoader and CastleRAT components from skipraid[.]com , using the distinctive K8VGmQTrzX User-Agent string. Cas |
| sha256 | 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 | be05561f3a19c7fc2d08e38c97e1986bbc5 SHA256 of SloppyRAT DLL 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SHA256 of SloppyRAT DLL bdcf8fe230e23692b658b62b6547374e223 |
| sha256 | 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990 | 091743cf567396201eff7731f5475768f9a SHA256 of SloppyRAT DLL 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990 SHA256 of SloppyRAT DLL ff142fc192daa2a83bc565e5b38ebbe0556 |
| sha256 | 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a | vent. Indicators Of Compromise (IOCs) Indicator Description 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a SHA256 of SloppyRAT DLL 8774533134d9d1514106c4090a0c5bccab4 |
| sha256 | bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd | bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SHA256 of SloppyRAT DLL bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd SHA256 of SloppyRAT DLL Note: IP addresses and domains are |
| sha256 | ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5 | bccab4550facdcfe03f4e02b9764343a990 SHA256 of SloppyRAT DLL ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SHA256 of SloppyRAT DLL 680c3a9f5fdddfcc34856c7a67d21bbdd2b |
From the original article
4 min read at gbhackers.com
A new Windows remote-access trojan dubbed SloppyRAT, which appears to be positioned as an intrusion-enablement tool for ransomware operations. First observed in June 2026, the malware is delivered through a multi-stage ClickFix chain and combines host reconnaissance, stealthy command execution, reverse proxying, and resilient command-and-control mechanisms to support post-compromise activity and lateral movement.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.