New Windows RAT "SloppyRAT" Emerges as Ransomware Enabler
A recently identified Windows remote-access trojan (RAT), dubbed SloppyRAT, has been observed in the wild as a tool for ransomware operations. First detected in June 2026, the malware employs a multi-stage ClickFix infection chain to evade detection while enabling post-compromise activity, lateral movement, and reverse proxying.
Infection Chain & Execution
SloppyRAT avoids traditional executable drops by abusing the legacy finger.exe utility (TCP port 79) to fetch a batch script from an attacker-controlled server. The script then:
- Copies curl.exe to the user’s AppData directory under a numeric .com filename.
- Downloads IronPython from GitHub to execute a compressed, Base64-encoded Python payload.
- Retrieves CastleLoader and CastleRAT components from skipraid[.]com using the K8VGmQTrzX User-Agent string tools previously linked to deceptive delivery campaigns and remote control.
The final stage fetches config.py from Azure Blob Storage, reflectively loading SloppyRAT from a DLL (hostfxr.dll) with the User-Agent Mozilla/5.0 (compatible; DLLMemLoader/1.0).
Capabilities & Evasion Techniques
SloppyRAT supports a range of reconnaissance and command-execution functions, including:
- Host enumeration (processes, services, users, network connectivity).
- File/registry manipulation, WMI queries, and Defender preference alteration.
- 47 PowerShell-like commands implemented in C++ (e.g., whoami, Get-Process) to reduce reliance on PowerShell logs.
- Arbitrary PowerShell execution via in-process .NET CLR invocation (PSInline).
For persistence, the malware attempts to modify the Run registry key but fails due to incorrect DLL path invocation. It also executes commands via Win32_Process::Create (WMI) to blend into legitimate admin activity.
A key feature is its reverse SOCKS proxy, allowing attackers to route traffic through infected endpoints for internal network reconnaissance and lateral movement.
Defensive Evasion & C2 Resilience
SloppyRAT employs multiple obfuscation techniques:
- Per-string XOR encryption, API hashing, and indirect syscalls (Hell’s Gate-style).
- TLS certificate pinning to block man-in-the-middle inspection.
- EtherHiding fallback for C2 resolution via Polygon blockchain (though no active smart-contract addresses were observed).
Despite flawed persistence logic and other errors, its current capabilities pose a significant threat for ransomware-affiliated intrusions.
Indicators & Detection Opportunities
Security teams should monitor for:
- Outbound TCP/79 traffic (finger.exe abuse).
- Unexpected IronPython or pythonw.exe executions from user-writable directories.
- Domains linked4x[.]com, skipraid[.]com, and Azure Blob Storage paths.
- User-Agent strings K8VGmQTrzX and DLLMemLoader/1.0.
- ClickFix lures prompting users to paste commands into Run, PowerShell, or Terminal.
Hashes (SHA-256):
- 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a
- 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990
- ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5
- 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21
- bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd
Microsoft Threat Intelligence cybersecurity rating report: https://www.rankiteo.com/company/microsoft-threat-intelligence
"id": "MIC1789115702",
"linkid": "microsoft-threat-intelligence",
"type": "Ransomware",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'attack_vector': 'Multi-stage ClickFix infection chain, abuse of finger.exe '
'utility, malicious batch script execution, IronPython '
'exploitation, DLL reflective loading',
'data_breach': {'data_encryption': 'RAT capabilities include data '
'manipulation, but no specific encryption '
'mentioned beyond ransomware context'},
'date_detected': '2026-06',
'description': 'A recently identified Windows remote-access trojan (RAT), '
'dubbed SloppyRAT, has been observed in the wild as a tool for '
'ransomware operations. The malware employs a multi-stage '
'ClickFix infection chain to evade detection while enabling '
'post-compromise activity, lateral movement, and reverse '
'proxying.',
'impact': {'operational_impact': 'Potential unauthorized access, lateral '
'movement, reverse proxying for further '
'attacks',
'systems_affected': 'Windows systems'},
'initial_access_broker': {'backdoors_established': 'Reverse SOCKS proxy, DLL '
'reflective loading',
'entry_point': 'ClickFix infection chain, '
'finger.exe abuse'},
'motivation': 'Ransomware enablement, lateral movement, reverse proxying for '
'internal reconnaissance',
'post_incident_analysis': {'root_causes': 'Abuse of legitimate utilities, '
'multi-stage evasion techniques, '
'flawed persistence logic '
'exploitation'},
'ransomware': {'data_encryption': 'Potential (as a ransomware enabler)',
'data_exfiltration': 'Potential (reverse SOCKS proxy for '
'lateral movement)'},
'recommendations': ['Monitor for outbound TCP/79 traffic (finger.exe abuse)',
'Detect unexpected IronPython or pythonw.exe executions '
'from user-writable directories',
'Block or monitor domains linked4x[.]com, skipraid[.]com, '
'and Azure Blob Storage paths',
'Alert on User-Agent strings K8VGmQTrzX and '
'DLLMemLoader/1.0',
'Educate users about ClickFix lures and command-pasting '
'risks'],
'references': [{'source': 'Cyber Incident Description'}],
'response': {'enhanced_monitoring': ['Outbound TCP/79 traffic (finger.exe '
'abuse)',
'Unexpected IronPython or pythonw.exe '
'executions from user-writable '
'directories',
'Domains linked4x[.]com, skipraid[.]com, '
'and Azure Blob Storage paths',
'User-Agent strings K8VGmQTrzX and '
'DLLMemLoader/1.0',
'ClickFix lures prompting users to paste '
'commands']},
'title': "New Windows RAT 'SloppyRAT' Emerges as Ransomware Enabler",
'type': 'RAT (Remote Access Trojan)',
'vulnerability_exploited': 'Abuse of legitimate utilities (finger.exe, '
'curl.exe, IronPython), lack of detection for '
'unusual User-Agent strings, flawed persistence '
'logic exploitation'}