RESEARCHERS at Zscaler ThreatLabz have analysed SloppyRAT, a Windows remote access tool reportedly used by suspected ransomware operators to establish an early foothold in corporate networks. The activity, identified in June 2026, relies on social engineering rather than a software vulnerability. In a ClickFix lure, victims are persuaded to run a command that abuses the legitimate Windows `finger.exe` utility to download a batch script.
That script copies and renames `curl.exe` in a hidden directory, then uses it to retrieve an IronPython package disguised as a PDF from GitHub. IronPython runs an encoded Python loader that downloads CastleLoader, CastleRAT and ultimately SloppyRAT.
The SloppyRAT DLL is reflectively loaded into memory, reducing files left on disk. It communicates over HTTPS with JSON messages, using a hardcoded API key, certificate pinning and encrypted strings and code blocks. Researchers said it has 47 built-in commands, 13 functions protected by runtime decryption, RC4-encrypted results and a reverse SOCKS proxy that could support internal network movement. As a fallback, EtherHiding retrieves command-and-control information from the Polygon blockchain.
The report does not state that ransomware deployment was confirmed in the described incidents, but says defenders may have time to intervene between initial execution and later ransomware activity. Recommended measures include blocking outbound `finger.exe` traffic, particularly on TCP port 79, monitoring for unexpected IronPython use, renamed system utilities in unusual user directories and suspicious proxy connections, and isolating affected endpoints. Patching is not applicable because the campaign does not exploit a known vulnerability.