Security researchers have identified a new remote access trojan called SloppyRAT that combines multiple stealth techniques with capabilities that could allow attackers to establish an initial foothold, gather intelligence, and move through corporate networks before deploying ransomware.
Zscaler ThreatLabz identified the malware in June 2026 while investigating a multi-stage infection campaign that relied on a ClickFix-style technique to persuade victims to execute malicious commands. Although researchers found several programming errors that indicate the malware remains under development, its current capabilities already provide attackers with a substantial set of tools for reconnaissance, remote command execution, network proxying, and lateral movement.
SloppyRAT stands out for combining encrypted code, indirect Windows system calls, certificate pinning, and a blockchain-based backup mechanism for locating its command-and-control infrastructure, giving attackers several layers of protection against detection and disruption.
ClickFix Campaign Builds the Infection Chain
The attack begins with a social-engineering lure designed to convince victims to run a command on their Windows systems. The command abuses the legitimate Windows finger.exe utility to retrieve a batch script from an attacker-controlled domain.
The Finger protocol normally operates over TCP port 79. Because the protocol has limited legitimate use in most enterprise environments, security teams can reduce exposure by blocking outbound traffic over port 79 and restricting unnecessary access to finger.exe.
The downloaded script copies the legitimate Windows curl.exe utility into the user’s AppData directory before renaming it with a numeric filename ending in .com. It subsequently downloads an IronPython package hosted on GitHub while disguising the archive as a PDF file.
IronPython is then used to execute a compressed and Base64-encoded Python stage. That stage downloads CastleLoader and CastleRAT from another attacker-controlled domain. The attackers subsequently deploy an additional Python interpreter and execute a script called config.py hosted through Azure Blob Storage.
The script downloads the SloppyRAT DLL and hostfxr.dll before reflectively loading the malware directly into memory. By minimizing the need to write the main payload to disk, the technique can reduce forensic artifacts and make traditional file-based investigation more difficult.
Researchers observed that the loader used a User-Agent string identifying itself as DLLMemLoader/1.0.
Malware Uses Multiple Evasion Techniques
SloppyRAT incorporates several mechanisms designed to complicate analysis and security monitoring. The malware conceals strings through XOR encryption and uses runtime code decryption to protect 13 important functions.
It also inserts junk code and employs a Hell’s Gate-style approach to invoke Windows system calls directly. Such techniques can help malware avoid security products that rely heavily on monitoring or hooking commonly used Windows application programming interfaces.
The malware communicates with its command-and-control server over HTTPS using JSON messages. It also implements certificate pinning, comparing the server certificate against a hardcoded SHA-256 hash. If the certificate does not match the expected value, SloppyRAT terminates the connection.
This behavior can interfere with security tools that attempt to inspect encrypted network traffic through a TLS man-in-the-middle configuration.
SloppyRAT Collects Host Intelligence
The malware uses a hardcoded API key to authenticate with its command-and-control infrastructure. Once connected, it can transmit information about the infected computer, installed security products, command results, and operational errors.
According to Zscaler, much of the collected information is encrypted with RC4 before being encoded using Base64. The combination allows attackers to maintain communication while adding another layer of obfuscation to data exchanged with compromised systems.
Researchers also identified coding flaws within SloppyRAT, suggesting that its developers are still refining the malware. However, the weaknesses have not prevented the current version from providing capabilities that could support a broader intrusion.
The combination of initial access, reconnaissance, remote execution, and lateral movement makes SloppyRAT a potentially useful component in ransomware operations. Its continued development could increase the threat as attackers refine its evasion and network-control capabilities.
