Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

Cybersecuritynews •Tushar Subhra Dutta • September 11, 2026

SloppyRAT is a remote access tool that appears designed to help ransomware operators move deeper into compromised networks. The malware arrives through ClickFix, a social-engineering method that tricks people into running commands presented as a routine check. Rather than immediately encrypting files, the attackers establish a foothold, collect system details, and reach other devices, giving […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SloppyRAT: New Remote Access Trojan Fuels Ransomware Operations In June 2026, Zscaler ThreatLabz identified SloppyRAT, a new remote access trojan (RAT) used in ransomware attacks. Delivered through a multi-stage ClickFix infection chain, SloppyRAT employs advanced evasion techniques, including encrypted code and indirect Windows system calls. The malware allows attackers to establish a foothold, gather intelligence, and move laterally within corporate networks. It uses the legitimate Windows finger.exe utility to execute commands and download malicious scripts. The malware's development is ongoing, as indicated by several programming errors found in its code. Security teams can mitigate risks by blocking outbound traffic on TCP port 79 and restricting access to finger.exe. The current status of SloppyRAT indicates it is actively being used in the wild, posing a significant threat to organizations. Researchers have noted that the malware's capabilities include network proxying and stealthy command execution. 4 sources 69

Extracted Entities

Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (1)