Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

Gbhackers •Mayura Kathir • September 11, 2026

A new Windows remote-access trojan dubbed SloppyRAT, which appears to be positioned as an intrusion-enablement tool for ransomware operations. First observed in June 2026, the malware is delivered through a multi-stage ClickFix chain and combines host reconnaissance, stealthy command execution, reverse proxying, and resilient command-and-control mechanisms to support post-compromise activity and lateral movement. Rather than […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SloppyRAT: New Remote Access Trojan Fuels Ransomware Operations In June 2026, Zscaler ThreatLabz identified SloppyRAT, a new remote access trojan (RAT) used in ransomware attacks. Delivered through a multi-stage ClickFix infection chain, SloppyRAT employs advanced evasion techniques, including encrypted code and indirect Windows system calls. The malware allows attackers to establish a foothold, gather intelligence, and move laterally within corporate networks. It uses the legitimate Windows finger.exe utility to execute commands and download malicious scripts. The malware's development is ongoing, as indicated by several programming errors found in its code. Security teams can mitigate risks by blocking outbound traffic on TCP port 79 and restricting access to finger.exe. The current status of SloppyRAT indicates it is actively being used in the wild, posing a significant threat to organizations. Researchers have noted that the malware's capabilities include network proxying and stealthy command execution. 4 sources 69

Extracted Entities

Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)