SloppyRAT: ClickFix-delivered DLL backdoor stages CastleLoader and CastleRAT ahead of ransomware attacks

Zscaler ThreatLabz detailed SloppyRAT, a DLL-based backdoor (described by GBHackers as a C++ implant) first observed in June 2026 and delivered via ClickFix lures abusing finger.exe on TCP port 79; it stages CastleLoader and CastleRAT, then provides…

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor that GBHackers describes as a C++ implant and Cyber Security News links to a ransomware-related threat actor; GBHackers and Cyber Security News both say it was first observed in June 2026. The infection chain begins with a ClickFix lure abusing Windows finger.exe over TCP port 79 to fetch a batch script, then uses curl.exe (Zscaler says it copies curl.exe; GBHackers says a renamed curl.exe in AppData) to download IronPython 3.4.2 from GitHub and execute zlib-compressed, Base64-encoded Python that deploys CastleLoader and CastleRAT. The sources disagree on the final loading step: Zscaler and Cyber Security News say the SloppyRAT DLL is reflectively loaded in memory, while GBHackers says the final stage loads it from hostfxr.dll via Azure Blob Storage. The implant implements 47 PowerShell-like commands in C++ via native APIs; GBHackers describes Hell's Gate-style direct syscalls while Cyber Security News describes indirect syscalls. Capabilities include system inventory, file operations, WMI execution toward file servers and high-value assets, Microsoft Defender tampering, and a reverse SOCKS proxy that lets operators pivot from one endpoint into internal networks. C2 runs over a reverse SOCKS channel with certificate-pinned HTTPS; GBHackers reports an EtherHiding fallback via Polygon JSON-RPC, which Cyber Security News characterizes as possible. Evasion includes XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks (Zscaler), plus runtime code encryption. Persistence attempts via Run key and COM hijacking are broken or buggy, suggesting the family is under active development. Zscaler assesses SloppyRAT as an intrusion-enablement tool for ransomware operations; defenders can block TCP port 79 egress and finger.exe, and Cyber Security News notes the pre-encryption foothold offers a window to stop intrusions. GBHackers hunt indicators include linked4x.com, skipraid.com, K8VGmQTrzX, and a DLLMemLoader/1.0 user-agent.

• SloppyRAT is a DLL-based backdoor (GBHackers describes it as a C++ implant), first observed in June 2026 per GBHackers and Cyber Security News, and linked by Cyber Security News to a ransomware-related threat actor.
• Delivered via multi-stage ClickFix lures abusing Windows finger.exe over TCP port 79 to fetch a batch script.
• Uses curl.exe (Zscaler: copied; GBHackers: renamed in AppData) to download IronPython 3.4.2 from GitHub, which runs zlib-compressed, Base64-encoded Python staging CastleLoader and CastleRAT.
• Final loading step disputed: Zscaler and Cyber Security News say the SloppyRAT DLL is reflectively loaded in memory; GBHackers says the final stage loads it from hostfxr.dll via Azure Blob Storage.
• C++ implant implements 47 PowerShell-like commands via native APIs; GBHackers describes Hell's Gate-style direct syscalls while Cyber Security News describes indirect syscalls.
• Capabilities include system inventory, file operations, WMI execution, Microsoft Defender tampering, and reverse SOCKS proxying enabling pivoting from one endpoint into internal networks toward file servers and high-value assets.
• C2 uses a reverse SOCKS channel with certificate-pinned HTTPS; GBHackers reports an EtherHiding fallback via Polygon JSON-RPC, which Cyber Security News calls possible.
• Evasion includes XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks (Zscaler), plus runtime code encryption.