New SloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware Hackers | #ransomware | #cybercrime

Security researchers have uncovered a new remote access trojan named SloppyRAT that may help ransomware operators gain an initial foothold, collect intelligence, and move across corporate networks.

Zscaler ThreatLabz identified the malware in June 2026 after observing a multi-stage ClickFix infection chain.

SloppyRAT combines several modern evasion methods, including encrypted code, indirect Windows system calls, certificate pinning, and a blockchain-based backup method for locating its command-and-control (C2) infrastructure.

Despite its advanced features, researchers found several coding flaws in the malware. These errors suggest SloppyRAT is still under active development.

However, its existing capabilities are sufficient to support reconnaissance, remote command execution, proxying, and lateral movement before a possible ransomware deployment.

SloppyRAT ClickFix Aids Ransomware

The infection begins with a ClickFix-style lure that tricks victims into running a command. The command abuses the legitimate Windows finger.exe utility to retrieve a batch script from finger.linked4x[.]com.

The Finger protocol normally communicates over TCP port 79. Since most enterprises do not need this protocol, defenders can reduce risk by blocking outbound port 79 traffic and restricting the use of finger.exe.

The downloaded script copies Windows curl.exe into the user’s AppData folder and renames it with a numeric filename ending in .com. It then downloads IronPython from GitHub, disguising the archive as a PDF file.

IronPython executes a compressed and Base64-encoded Python stage. This stage downloads CastleLoader and CastleRAT from skipraid[.]com. The attackers then deploy another Python interpreter and execute a script named config.py from an Azure Blob Storage location.

The Python script downloads the SloppyRAT DLL, hostfxr.dll, and reflectively loads it in memory. This method reduces visible files on disk and can make investigation harder.

Researchers noted the loader used the User-Agent string Mozilla/5.0 (compatible; DLLMemLoader/1.0).

SloppyRAT hides strings using XOR encryption and protects 13 important functions with runtime code decryption. It also adds junk code and uses a Hell’s Gate-style technique to call Windows system calls directly. These methods can bypass some security products that monitor or hook common Windows APIs.

The malware communicates with its C2 server through HTTPS and JSON messages. It uses certificate pinning by checking the server certificate against a hardcoded SHA-256 hash.

If the certificate differs, SloppyRAT closes the connection. This can prevent network tools from inspecting encrypted traffic through a TLS man-in-the-middle setup.

The malware authenticates using a hardcoded API key and reports host details, security-product information, command output, and errors. It encrypts much of this data with RC4 before Base64 encoding it, Zscaler said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC