Executive Summary
In June 2026, Zscaler ThreatLabz identified a new malware family named SloppyRAT, likely utilized by ransomware-affiliated threat actors to secure initial access and facilitate lateral movement. The infection begins with 'ClickFix' lures that exploit native Windows tools like finger.exe and curl.exe to deploy intermediate loaders such as CastleLoader and CastleRAT, eventually reflectively loading the SloppyRAT DLL into memory.
Technically, SloppyRAT is notable for its 'EtherHiding' capability, which uses the Polygon blockchain for C2 resolution to resist infrastructure takedowns. It employs sophisticated anti-analysis techniques including encrypted code blocks decrypted at runtime, junk code, and indirect system calls to bypass EDR monitoring. Despite its advanced features, the malware contains several implementation flaws, particularly in its persistence mechanisms (Run keys and COM hijacking), suggesting it is still actively evolving.
For organizations, this threat highlights the ongoing risk of native living-off-the-land (LotL) binaries being used for initial staging. The use of certificate pinning and blockchain C2 makes traditional network inspection and domain blacklisting more difficult, necessitating behavior-based detection and strict egress filtering on uncommon protocols like Finger (TCP 79).