SloppyRAT Attack Chain Uses ClickFix Lures to Enable Ransomware Operations

Researchers at Zscaler ThreatLabz have analysed SloppyRAT, a remote-access tool linked to suspected ransomware operators and discovered in June 2026. The malware targets Windows endpoints and relies on social engineering rather than a software vulnerability. In a ClickFix attack, users are persuaded to run a command that abuses the legitimate Windows `finger.exe` utility to download a batch script.

That script copies and renames `curl.exe` in a hidden directory, then uses it to download an IronPython package disguised as a PDF from GitHub. IronPython runs an encoded Python loader that retrieves CastleLoader, CastleRAT and eventually SloppyRAT.

The SloppyRAT DLL is reflectively loaded into memory, reducing files left on disk. It communicates over HTTPS with JSON messages, uses a hardcoded API key and certificate pinning, and encrypts strings and code blocks. Researchers identified 47 built-in commands, 13 protected functions, RC4-encrypted results and a reverse SOCKS proxy that could support internal network pivoting. As a fallback, EtherHiding obtains command-and-control information from the Polygon blockchain.

The report describes SloppyRAT as supporting ransomware operations, but does not state that the malware itself exploits a specific vulnerability or confirm particular ransomware deployments.

Defenders are advised to block outbound traffic from `finger.exe`, including TCP port 79, monitor for unexpected IronPython activity, renamed system utilities in unusual user directories and suspicious proxy connections. Because the initial step requires user execution and no known vulnerability is involved, awareness of ClickFix-style lures is relevant; patching alone would not address this campaign. Early detection and isolation may prevent later ransomware activity.