Do Son At a glance
- Malware family: SloppyRAT
- Threat actor: Suspected ransomware operators
- Targets or victims: Windows endpoints
- Delivery vector: Social engineering via ClickFix prompts
- Key capabilities: Built-in commands, encrypted code blocks, EtherHiding for C2 resolution
- Source: Zscaler ThreatLabz
TL;DR
In June 2026, researchers discovered a remote access tool named the SloppyRAT malware. The malware aids ransomware actors by establishing early footholds inside corporate networks. It relies heavily on social engineering rather than exploiting software flaws.
Delivery
The attack sequence begins with a ClickFix social engineering lure. Attackers persuade Windows users to manually run a command. This command uses the legitimate Windows finger.exe network utility. The command instructs the utility to download a malicious batch script from a remote server. The downloaded script then copies the legitimate Windows curl.exe into a hidden directory. It renames the file with a numeric name and a .com extension. This helps the attackers disguise a familiar Windows tool and evade simple file name detection. The renamed utility then downloads an IronPython package from GitHub. The archive is cleverly disguised as a PDF file to avoid arousing suspicion. By using standard system utilities, the attackers blend their malicious activity with normal system operations. This approach reduces the likelihood of triggering immediate security alerts.
Infection Chain
Once downloaded, IronPython executes a compressed and encoded Python script. This script acts as a loader for the subsequent payloads. It retrieves subsequent malware stages, including CastleLoader and CastleRAT. Ultimately, it downloads the SloppyRAT payload. A script reflectively loads the SloppyRAT DLL directly into memory. This fileless technique minimizes forensic artifacts on the physical disk. It makes traditional file-based investigations more difficult for defenders. The entire sequence avoids exploiting software vulnerabilities directly. Instead, it strings together legitimate utilities and programming environments to launch the threat. SloppyRAT incorporates several mechanisms designed to complicate analysis and security monitoring. Security analysts detailed this process in a recent technical analysis of SloppyRAT. The staged approach gives defenders a valuable period between initial execution and ransomware deployment.
Command-and-Control and Data-Exfiltration Behaviour
The SloppyRAT malware communicates over HTTPS using JSON-formatted messages. It authenticates with a hardcoded API key to ensure only authorized controllers can send commands. To obscure its communication, it encrypts strings and code blocks. Researchers note, “Stack strings are obfuscated with XOR using a unique 4-byte key for each string.” Furthermore, it implements certificate pinning. The malware compares the server certificate against a hardcoded hash. If the hash fails to match, the connection terminates. This prevents security tools from inspecting the TLS traffic using interception techniques.
SloppyRAT also implements EtherHiding as a backup channel. This fetches C2 information from the Polygon blockchain. Once connected, SloppyRAT can receive and execute instructions. It includes 47 built-in commands. The malware executes these commands using direct Windows system calls to bypass user-land monitoring. The malware uses runtime code decryption to protect 13 important functions. It also inserts junk code to confuse automated analysis tools. The results are encrypted with RC4 and sent back to the attackers. The malware also provides a reverse SOCKS proxy feature. This proxy functionality enables attackers to pivot into the internal network for lateral movement.
Defense or Detection Guidance
Organizations should block outbound connections from the finger.exe utility. Administrators can specifically restrict outbound traffic on TCP port 79. Security teams should monitor environments for unexpected IronPython activity. The campaign does not exploit a known software vulnerability, so patching is not applicable. The malware requires the user to execute the initial command. Therefore, user awareness training regarding social engineering remains critical. Defenders have a valuable window of time between the initial execution and ransomware deployment. Identifying and isolating affected endpoints early can stop an intrusion. Monitoring internal network traffic for unusual proxy connections can also help identify compromised hosts. Security teams must look for renamed system utilities operating out of unexpected user directories.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
