New SloppyRAT Malware Deploys via ClickFix for Ransomware Lateral Movement
A new remote access tool, SloppyRAT, is being distributed through social engineering tactics like ClickFix, enabling ransomware operators to conduct reconnaissance and move laterally within compromised networks before encryption.
A novel remote access tool dubbed SloppyRAT is emerging as a significant threat, designed to facilitate ransomware operations by enabling lateral movement within victim networks. Security researchers at Zscaler observed SloppyRAT in June 2026, linking its deployment to ransomware-related threat actors. Unlike malware that immediately encrypts files, SloppyRAT establishes a persistent foothold, allowing attackers to conduct reconnaissance, gather system information, and pivot to other devices before initiating the destructive encryption phase. This delay offers a critical window for defenders to detect and neutralize the threat before widespread data loss occurs.
The infection vector for SloppyRAT often involves a social engineering technique known as ClickFix. This method tricks unsuspecting users into executing commands presented as routine system checks or updates. The initial stage typically abuses legitimate Windows utilities, such as finger.exe, to download a batch script. This script then copies curl.exe to a user-accessible directory and retrieves components like IronPython. These elements are used to download subsequent stages of the attack, including loaders like CastleLoader and CastleRAT, which ultimately prepare the system for SloppyRAT's execution.
Once the initial stages are complete, a separate Python interpreter is employed to download a loader script. This script is responsible for fetching SloppyRAT as a Dynamic Link Library (DLL) and then reflectively loading it directly into memory. This in-memory loading technique is a common evasion tactic, as it minimizes the creation of disk-based artifacts, making the malware harder for endpoint security solutions and manual analysis to detect. Users might only perceive the completion of a seemingly innocuous verification step.
Upon successful execution, SloppyRAT establishes command and control (C2) communication over HTTPS. Its capabilities include extensive system reconnaissance, such as inventorying machine details, listing running processes and services, inspecting local user accounts, and reading files. It can also create or delete directories and launch new programs. Notably, SloppyRAT can manipulate Microsoft Defender settings, underscoring the importance of robust endpoint detection and response (EDR) solutions and strict access controls.
A particularly concerning feature of SloppyRAT is its ability to establish a reverse SOCKS proxy. This functionality allows an attacker to use the compromised endpoint as a pivot point, enabling them to access other internal network systems from a seemingly trusted position. This capability is crucial for ransomware operators aiming to spread laterally across an organization's network, escalating the potential impact of an initial compromise.
SloppyRAT incorporates several evasion techniques to thwart detection. It encrypts parts of its code until runtime, obfuscates critical strings, and employs indirect system calls to complicate static and dynamic analysis. The malware also attempts to bypass network inspection by pinning the expected server certificate, which can hinder the interception and analysis of its encrypted C2 traffic. For C2 infrastructure resilience, it includes a fallback mechanism that can resolve infrastructure through Polygon blockchain services, though researchers have not yet observed active use of smart contract addresses for this purpose.
Despite its sophisticated capabilities, SloppyRAT exhibits some flaws, particularly in its persistence mechanisms. Attempts to establish persistence via the Windows Run registry key and COM hijacking have been observed to fail due to incorrect DLL paths or missing export functions. However, the malware can fall back to using a legitimate PowerShell process with a spoofed parent process name (explorer.exe) if its primary in-memory PowerShell route fails. These developmental shortcomings do not negate the significant threat posed by its reconnaissance and lateral movement capabilities.
To mitigate the risks associated with SloppyRAT, organizations should block unnecessary outbound traffic on TCP port 79 and restrict the use of finger.exe. User training is paramount, emphasizing the danger of pasting commands into command-line interfaces based on web prompts. Security teams should monitor for unusual curl.exe copies, Python interpreters in unexpected locations, suspicious DLL memory loading, and outbound connections to known malicious infrastructure. Implementing strict network segmentation and monitoring for anomalous proxy behavior can further limit the potential for widespread damage.