Critical Ivanti EPMM CVE-2023-35078 Flaw Lets Attackers Access Devices

Key Takeaways

• SloppyRAT is a newly identified remote access Trojan (RAT) designed to facilitate lateral movement and reconnaissance for ransomware operations.
• It is delivered via “ClickFix,” a social engineering technique that tricks users into executing commands under the guise of system checks.
• Unlike immediate ransomware deployment, SloppyRAT establishes a persistent foothold, gathers system information, and extends access to other network devices.
• The malware employs several evasion tactics, including runtime code encryption, string obfuscation, and indirect system calls, though some persistence mechanisms are currently flawed.
• Defenders have a window to intervene before ransomware payload deployment, emphasizing the need for robust endpoint monitoring and user education.

SloppyRAT: A New Tool for Ransomware Lateral Movement

A new remote access tool, dubbed SloppyRAT, has emerged as a significant threat, appearing to be specifically engineered to assist ransomware operators in deepening their penetration into compromised networks. This malware’s primary objective is not immediate data encryption but rather to establish a robust foothold, gather critical system intelligence, and facilitate lateral movement across an organization’s digital infrastructure, thereby expanding the potential impact of a subsequent ransomware attack.

The infection chain leverages a social engineering tactic known as ClickFix. This method deceives users into executing seemingly routine system commands, inadvertently initiating the malware’s deployment. This strategic delay between initial compromise and the eventual ransomware payload provides a crucial window for defenders to detect and neutralize the threat before data encryption commences.

Discovery and Operational Chain

Zscaler said in a report that its researchers identified SloppyRAT in June 2026, linking its activities to a known ransomware-affiliated threat actor. The attack sequence involves several stages, beginning with the abuse of legitimate Windows utilities and Python components, followed by the deployment of the malware into memory.

Despite its dangerous capabilities, analysis of the code suggests that SloppyRAT is still under active development, indicating potential for further evolution. Its current functional toolkit already supports critical reconnaissance, remote command execution, and network pivoting, while its built-in encryption and evasion features are designed to complicate detection and containment efforts for security teams.

Hackers Deploy New SloppyRAT via ClickFix

The initial compromise for SloppyRAT begins with a ClickFix social engineering lure. This typically involves instructing a target to execute a command, often abusing the seldom-used Windows finger.exe utility to retrieve a batch script. The Finger protocol, which typically operates over TCP port 79, is an antiquated service rarely found in modern corporate environments, making its use by attackers a notable anomaly.

The retrieved script then copies a legitimate curl.exe executable into the user profile, renaming it with a numeric .com extension to mask its true identity. Subsequently, it downloads IronPython, which executes compressed and Base64-encoded code responsible for fetching subsequent stages of the attack, including components named CastleLoader and CastleRAT. This technique mirrors earlier ClickFix campaigns, such as those deploying PavinLoader, highlighting the effectiveness of fake verification prompts as a delivery mechanism.

A distinct Python interpreter then retrieves a loader script that fetches SloppyRAT as a Dynamic Link Library (DLL) and loads it reflectively into memory. This in-memory execution strategy minimizes disk artifacts, making the infection less visible to both the user, who believes they merely completed a verification step, and traditional endpoint detection tools.

Once operational, SloppyRAT possesses a broad range of capabilities, including receiving commands over HTTPS, conducting system inventory, enumerating processes and services, inspecting local user accounts, reading files, managing directories, and launching new programs. Crucially, it can also query and modify Microsoft Defender settings, underscoring the importance of early detection and stringent access controls.

A particularly dangerous feature is its reverse SOCKS proxy functionality. This allows the compromised machine to act as a bridge, enabling attackers to connect to other systems within the internal network from an already trusted vantage point. This capability aligns with observed patterns in ClickFix campaigns, where initial user execution serves as a springboard for broader network compromise.

Evasion Features Meet Defensive Gaps

SloppyRAT incorporates several evasion techniques to hinder analysis and detection. It encrypts portions of its code until runtime, obfuscates meaningful strings, injects junk instructions, and utilizes indirect system calls to reduce the efficacy of static file analysis and basic behavioral checks. Furthermore, it employs certificate pinning for its command-and-control (C2) communications, preventing network inspection tools from intercepting and decrypting its traffic.

The malware’s C2 design also includes an EtherHiding fallback mechanism, intended to resolve infrastructure through Polygon blockchain services. While researchers have yet to discover a sample containing a smart-contract address, suggesting this feature might be incomplete, it signifies an intent to bolster C2 resilience against disruption. This concern about blockchain-backed malware delivery has been noted in other ClickFix campaigns, where attackers leverage decentralized services for operational support.

Interestingly, some of SloppyRAT’s persistence mechanisms are currently non-functional. It attempts to establish persistence via a Run registry entry and a COM hijacking method, but it fails to correctly provide the necessary DLL path and export function for either approach. Despite these flaws, the malware can still revert to using a legitimate PowerShell process, spoofing explorer.exe as its parent, if its in-memory PowerShell execution fails.

What You Should Do

• Block Outbound Traffic: Prohibit or strictly control outbound traffic on TCP port 79, as the Finger protocol is rarely legitimate in corporate environments.
• Control finger.exe: Prevent or tightly control the execution of finger.exe on endpoints.
• Educate Users: Train staff never to paste commands into Run, Command Prompt, Terminal, or PowerShell windows when prompted by a webpage or unverified source.
• Monitor for Anomalies: Watch for unusual renamed copies of curl.exe, Python interpreters in user-writable directories, suspicious DLL memory loading, and outbound connections to the listed Indicators of Compromise (IoCs).
• Implement Network Segmentation: Restrict administrative access between network segments to limit lateral movement if an endpoint is compromised.
• Investigate Proxy Behavior: Actively investigate any remote proxy behavior originating from internal systems, as this is a key capability of SloppyRAT.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.