Zscaler ThreatLabz details SloppyRAT malware used in ransomware attacks

Zscaler’s ThreatLabz research team has identified a new malware family it calls SloppyRAT, which it says is likely used by a ransomware-related threat actor to establish a foothold for lateral movement. The malware was observed being delivered through a multi-stage ClickFix infection chain.

SloppyRAT includes a large set of built-in PowerShell-like commands, encrypted code blocks decrypted at runtime, certificate pinning, and an EtherHiding implementation that resolves command-and-control through the Polygon blockchain as a backup channel. ThreatLabz said the codebase contains numerous software flaws, including persistence routines that appear to be implemented incorrectly, suggesting the tool is still under development.