Threats Tagged 'certificate pinning'

SloppyRAT is a newly identified malware family from June 2026, used by ransomware-related threat actors to establish footholds and enable lateral movement. It is delivered via multi-stage ClickFix infection chains and employs advanced evasion techniques such as encrypted code blocks, EtherHiding for command-and-control resolution using the Polygon JSON-RPC protocol, and certificate pinning to prevent TLS inspection. The malware includes 47 built-in PowerShell-like commands for remote access and uses components like CastleLoader and CastleRAT. Despite its sophistication, the malware contains numerous software bugs affecting persistence and other features, indicating it is still under active development.