Security 1 publisher2 min readPublished September 10, 2026 at 8:28 AM PDT

SloppyRAT parks its backup C2 channel on the Polygon blockchain

Zscaler's ThreatLabz found SloppyRAT in June 2026 at the end of a ClickFix chain whose live hosts are all ordinary domains, with a Polygon JSON-RPC lookup held in reserve for when those domains stop answering.

The Watch · Security desk

Illustration accompanying SloppyRAT parks its backup C2 channel on the Polygon blockchain

What happened

Delivery is a ClickFix lure that invokes the Windows finger.exe client to download and execute a batch script from finger.linked4x[.]com.
That script renames curl to fetch IronPython from GitHub, which runs encoded Python that pulls further stages, ending in CastleLoader and then CastleRAT.
A config.py script from an actor-controlled Azure blob then reflectively loads the SloppyRAT DLL, hostfxr.dll, in memory and invokes its export f3b980dea.
SloppyRAT carries an EtherHiding implementation that resolves C2 over Polygon JSON-RPC as a backup channel, which ThreatLabz says can hinder disruption efforts.

Compiled by The WatchSomething wrong?How this is made

Why it matters

capability A registrar seizure or a sinkhole removes the primary path and leaves the resolution channel standing, because a read against a public chain has no host to seize and no owner to notify.
cost An egress block on TCP port 79 plus an execution block on the Windows Finger client costs most enterprises nothing, and it ends this chain at its first hop.
constraint Certificate pinning keeps the TLS session opaque to inspection appliances, so anyone hunting this has to work from host artefacts rather than decrypted traffic.
exposure Two stages arrive from GitHub and Azure blob storage, so egress policy built on domain reputation waves them through.

Every hostname in the documented path has an owner who can be served notice: a registrar for linked4x.com and skipraid.com, and Microsoft for the storage account that handed over both config.py and the SloppyRAT DLL ^[8]^[13]^[14]^[15]. Four hostnames sit in that path before SloppyRAT is running in memory, three of them the actor's, one of those three hosted on Azure ^[16]. Remove all three and the implant still has somewhere to ask for instructions, because ThreatLabz describes the EtherHiding code as a backup C2 channel resolved over Polygon JSON-RPC, and a read against a public chain has no registrar to serve ^[4].

What the writeup does not carry matters for anyone trying to act on it. There is no contract address, no RPC endpoint, and no statement that the fallback carried traffic during the observed intrusion ^[18]. An operator who wants to pre-empt the channel is left blocking outbound access to public RPC providers wholesale, which is a different conversation from adding two domains to a blocklist.

The trend reading is thinner than the technique reading. This is one family that ThreatLabz assesses is likely used by a ransomware-related actor for foothold and lateral movement ^[1]^[7]. No ransomware brand is named in the research, and one implementation in one buggy binary is not a migration across crews.

Stage one is the cheap kill. The lure runs finger.exe against finger.linked4x.com, and Finger speaks TCP port 79 ^[8]^[9]. ThreatLabz notes that most corporate environments need neither the protocol nor the binary, so egress filtering on 79 plus an execution block on finger.exe ends the chain before curl is ever renamed ^[9]^[10].

Past that point the chain is loud on the host. curl.exe copied into AppData under an all-digits filename with a .com extension ^[10]. IronPython 3.4.2 pulled from GitHub and written to disk as a .pdf ^[11]. A second Python interpreter dropped rather than reusing the first, bringing the count to two ^[14]^[17]. A reflective in-memory load of hostfxr.dll through export f3b980dea, requested with a User-Agent that says DLLMemLoader/1.0 ^[15]. Certificate pinning keeps the TLS content away from a network sensor ^[5], so the detection has to come off the endpoint, and the endpoint has plenty to work with.

The codebase is also unfinished, with numerous flaws that ThreatLabz says break some features ^[6], and the takedown-resistant fallback got built regardless.

What to watch

Whether ThreatLabz or another vendor publishes the Polygon contract address and RPC endpoint SloppyRAT queries, which is what would make the fallback blockable rather than theoretical.
Whether SloppyRAT turns up in an incident tied to a named ransomware brand, moving 'likely ransomware-related' to actual attribution.
Whether a later build fixes the flaws that currently break some features, which would mark the tool moving from development into routine use.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
In June 2026, Zscaler ThreatLabz identified a new malware family tracked as SloppyRAT that is likely leveraged by a ransomware-related threat actor.
ReportedSupportedSource: Zscaler ThreatLabzView cited source
[2]
ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain.
ReportedSupportedView cited source
[3]
SloppyRAT supports a large number of built-in PowerShell-like commands and uses anti-analysis techniques including encrypted code blocks decrypted and executed at runtime, junk code, and indirect system calls.
ReportedSupportedView cited source
[4]
SloppyRAT has an EtherHiding implementation as a backup channel for command-and-control, resolving C2 through the Polygon JSON-RPC protocol, which ThreatLabz says can be used to hinder disruption efforts.
ReportedSupportedSource: Zscaler ThreatLabzView cited source
[5]
SloppyRAT uses certificate pinning to prevent network monitoring solutions from using man-in-the-middle attacks to inspect its TLS traffic.
ReportedSupportedView cited source
[6]
The SloppyRAT codebase includes numerous software flaws that impact some of its features, which ThreatLabz says suggests it is still under development.
ReportedSupportedView cited source
[8]
ThreatLabz observed SloppyRAT distributed via a ClickFix style lure that used finger.exe to download and execute a batch script from finger.linked4x[.]com.
ReportedSupportedView cited source
[9]
The Finger protocol typically communicates over TCP port 79, most corporate environments do not require the tool or protocol, and ThreatLabz says organizations can block egress traffic on port 79 and block execution of finger.exe.
ReportedSupportedSource: Zscaler ThreatLabzView cited source
[10]
The downloaded batch script copies the native Windows curl.exe into the AppData directory under a filename consisting of numbers with a .com extension.
ReportedSupportedView cited source
[11]
The renamed curl executable downloads IronPython 3.4.2 from a github.com/IronLanguages release URL, writing it to AppData as IronPython.3.4.2.pdf.
ReportedSupportedView cited source
[12]
IronPython is renamed and used to execute zlib-compressed Base64-encoded Python code that downloads and runs additional stages, leading to the deployment of CastleLoader and ultimately CastleRAT.
ReportedSupportedView cited source
[13]
The CastleLoader and CastleRAT components were downloaded from skipraid[.]com using the User-Agent string K8VGmQTrzX.
ReportedSupportedView cited source
[14]
Alongside CastleRAT the threat actor deployed an additional Python interpreter written to disk instead of reusing IronPython, then used pythonw.exe to download and execute config.py from stro7121.blob.core.windows[.]net/dpp1/config.py.
ReportedSupportedView cited source
[15]
The config.py script downloaded a SloppyRAT DLL, hostfxr.dll, from the same Azure blob path and reflectively loaded it in memory, invoking the export f3b980dea, using the User-Agent Mozilla/5.0 (compatible; DLLMemLoader/1.0).
ReportedSupportedView cited source
[16]
The documented chain touches four distinct hostnames before SloppyRAT is loaded in memory, three of them actor-operated: finger.linked4x[.]com, skipraid[.]com, and the stro7121 Azure blob storage account, with github.com being the legitimate IronPython release host.
DerivedSupported1 source— sign in to open
[17]
The chain writes two Python interpreters to disk: IronPython 3.4.2 and the additional interpreter deployed alongside CastleRAT.
DerivedSupported1 source— sign in to open
[18]
The ThreatLabz writeup describes the EtherHiding fallback but publishes no Polygon contract address, no RPC endpoint, and no statement that the fallback channel carried traffic during the observed intrusion.
DerivedSupported1 source— sign in to open
[7]
ThreatLabz assesses SloppyRAT is likely used in ransomware attacks to establish a foothold for lateral movement.
ReportedInsufficientSource: Zscaler ThreatLabzView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

zscaler.com
1 article · September 10, 2026
SloppyRAT: A New Tool For Ransomware Attacks

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The mechanics are the most valuable part of Zscaler's account, and they are unusually complete: cmd.exe with caret-escaped arguments calls finger.exe, the batch script copies Windows' own curl.exe into AppData under a digits-only .com name, that copy pulls IronPython 3.4.2 straight from the IronLanguages GitHub release and saves it as IronPython.3.4.2.pdf, and the renamed interpreter runs a zlib-plus-Base64 blob that ends in a reflectively loaded hostfxr.dll with the export f3b980dea. Every binary up to that DLL either ships with Windows or belongs to a legitimate open-source project, which is what makes the chain awkward to catch on file reputation alone. The Polygon resolver is the one component a builder cannot follow: Zscaler describes the affine cipher protecting its strings but publishes no contract address, so the fallback is not reproducible outside its lab.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence62

0100

Deep detail, one witness

The artefacts are specific enough to hunt with tonight: a full command line with caret escaping, the numeric .com copy of curl.exe, three staging hosts, an export name, two User-Agent strings, an affine cipher with modulus 127. Specificity is not corroboration. Zscaler is the sole account, the published portion carries no sample hashes for anyone else to verify, and the sentence the headline value depends on — that this belongs to ransomware operations — arrives hedged as 'likely'.

Adoption18

0100

One intrusion, no scale

Every reference to the intrusion is singular: one chain, one analysed DLL, one Azure account. Zscaler gives no victim count, no sector, no geography and no campaign volume, and its own assessment that the code is still buggy points to tooling early in its life rather than one in broad use.

Hype gap

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
Fake GTA 6 installer destroys files behind a staged "License not found" error
1 publisher
security
5,400 hacked WordPress and PrestaShop sites pull their ClickFix payload from a BNB testnet contract
1 publisher
security
Symantec finds attackers installing the signed Node.js runtime to run their payloads
1 publisher
security
C2Looper puts its C2 inside GitHub, and domain-reputation stacks will not care
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources