{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 2, "deduplicated_iocs": 35, "direct_entities": 79, "direct_relationships": 152, "invalid_iocs": 0, "iocs": 35, "mentioned": 3, "mitre_associated": 2, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 6, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 154, "excluded_graph_objects": 840, "graph_complete": true, "graph_objects": 79, "graph_relationships": 152, "mitre_context_complete": true, "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "status_as_of": "2026-10-10T05:07:32+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:27.525Z", "updated_at": "2026-09-26T05:09:29.506Z" }, "description_available": false, "entity_type": "StixFile", "id": "012048cb-cb41-4202-8038-3a077ce64694", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--0c8da971-01e5-5665-ad01-067f792f4dda", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.937Z", "created_at": "2026-09-26T05:09:55.544Z", "modified": "2026-09-26T05:10:18.552Z", "updated_at": "2026-09-26T05:10:18.552Z" }, "description_available": false, "entity_type": "Indicator", "id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--923ae8aa-8fbb-51a3-92c4-7e45cd14df0f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.954Z", "created_at": "2026-09-26T05:10:01.698Z", "modified": "2026-09-26T05:10:27.708Z", "updated_at": "2026-09-26T05:10:27.708Z" }, "description_available": false, "entity_type": "Indicator", "id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--695643ca-d9fa-51c3-8610-6e729fe776f3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:19.952Z", "updated_at": "2026-09-26T05:09:20.180Z" }, "description_available": false, "entity_type": "StixFile", "id": "09d65463-290b-4ece-b7b8-73fa2be371b3", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--f07f882f-ea3b-56d0-9a91-f415ba5f48e6", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:45.139Z", "updated_at": "2026-09-26T05:09:45.742Z" }, "description_available": false, "entity_type": "Url", "id": "09f6d8a2-c77c-4d2a-ac79-80e2083c84ac", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "url--12b2c91c-8619-5eb0-b52f-2f13e3e4c9f5", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:31.966Z", "updated_at": "2026-09-26T05:09:32.671Z" }, "description_available": false, "entity_type": "StixFile", "id": "150a3879-8d13-4d1a-835c-c62386c60861", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--4c7c226f-6e50-55b6-b766-89e8bcd26fb7", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.031Z", "created_at": "2026-09-26T05:10:21.648Z", "modified": "2026-09-26T05:12:00.164Z", "updated_at": "2026-09-26T05:12:00.164Z" }, "description_available": false, "entity_type": "Indicator", "id": "173ea392-25c8-45d3-8dea-f8a306686a9a", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--4b4df989-983b-5776-87bf-f4b74626fc25", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.994Z", "created_at": "2026-09-26T05:10:14.431Z", "modified": "2026-09-26T05:11:12.224Z", "updated_at": "2026-09-26T05:11:12.224Z" }, "description_available": false, "entity_type": "Indicator", "id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--21c44840-a110-5e03-b211-8545e03a2995", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:25.673Z", "updated_at": "2026-09-26T05:09:26.230Z" }, "description_available": false, "entity_type": "StixFile", "id": "230575ef-d7eb-4719-8dfe-b969ec40a068", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--5036613e-6795-5809-a1e7-c89ff6a9c3c1", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:27.202Z", "updated_at": "2026-09-26T05:09:29.098Z" }, "description_available": false, "entity_type": "StixFile", "id": "27cefc1a-15b0-4975-a320-63f60256ff90", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--11126f6b-2f74-54ff-80d7-f1582690d9eb", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.957Z", "created_at": "2026-09-26T05:10:01.789Z", "modified": "2026-09-26T05:10:32.194Z", "updated_at": "2026-09-26T05:10:32.194Z" }, "description_available": false, "entity_type": "Indicator", "id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--f4a692a5-0a24-5117-86a2-4306adae430d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.009Z", "created_at": "2026-09-26T05:10:16.376Z", "modified": "2026-09-26T05:11:23.676Z", "updated_at": "2026-09-26T05:11:23.676Z" }, "description_available": false, "entity_type": "Indicator", "id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--5330d304-92e2-5183-a037-c75a0db9c4f3", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.017Z", "created_at": "2026-09-26T05:10:18.514Z", "modified": "2026-09-26T05:11:37.248Z", "updated_at": "2026-09-26T05:11:37.248Z" }, "description_available": false, "entity_type": "Indicator", "id": "37732468-5575-42ed-b9c7-1305a5083bb5", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--ba05cc3d-008a-577f-9578-b759f2145a93", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.006Z", "created_at": "2026-09-26T05:10:16.257Z", "modified": "2026-09-26T05:11:26.397Z", "updated_at": "2026-09-26T05:11:26.397Z" }, "description_available": false, "entity_type": "Indicator", "id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--c138404f-24f5-5af1-a377-597e5c013ad5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.991Z", "created_at": "2026-09-26T05:10:12.319Z", "modified": "2026-09-26T05:11:09.314Z", "updated_at": "2026-09-26T05:11:09.314Z" }, "description_available": false, "entity_type": "Indicator", "id": "39d64411-19f1-4a93-858b-f5069b0ea904", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--437dc1ac-b3d2-517e-9864-a50f889316fd", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.940Z", "created_at": "2026-09-26T05:09:55.570Z", "modified": "2026-09-26T05:10:16.045Z", "updated_at": "2026-09-26T05:10:16.045Z" }, "description_available": false, "entity_type": "Indicator", "id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--32fbc27f-0468-51f5-b234-177c48211f89", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:17.401Z", "updated_at": "2026-09-26T05:09:18.663Z" }, "description_available": false, "entity_type": "Hostname", "id": "42d3d254-0d95-4f03-9e67-a0064b8e2142", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "hostname--a65d0ef8-042a-52d0-aba0-858e71725c68", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:21.922Z", "updated_at": "2026-09-26T05:09:23.784Z" }, "description_available": false, "entity_type": "StixFile", "id": "446049ec-5e51-4e02-84a0-8a8f665f638d", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--f6f3a138-0b7d-5238-a1d4-8a10f07c3a9e", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:35.982Z", "updated_at": "2026-09-26T05:09:36.275Z" }, "description_available": false, "entity_type": "StixFile", "id": "4af466a5-997d-4c29-99cb-556abd9cc955", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--9e6c3db3-3888-55ff-b605-aa3018dfffb3", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:31.974Z", "updated_at": "2026-09-26T05:09:32.691Z" }, "description_available": false, "entity_type": "StixFile", "id": "4afcdf19-5bd9-4d3e-b031-75bd248f024e", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--54c930cc-18e4-54e4-8fbb-e6440c2b7e5f", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.932Z", "created_at": "2026-09-26T05:09:51.375Z", "modified": "2026-09-26T05:10:06.578Z", "updated_at": "2026-09-26T05:10:06.578Z" }, "description_available": false, "entity_type": "Indicator", "id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--c89e5d73-30ba-5c8e-9456-94dddd6cbda2", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:27.524Z", "updated_at": "2026-09-26T05:09:29.505Z" }, "description_available": false, "entity_type": "StixFile", "id": "516d3e92-26b1-483f-9852-977d56e00497", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--b293ad0a-baff-5aca-bff1-7a816c1468a0", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:41.310Z", "updated_at": "2026-09-26T05:09:42.050Z" }, "description_available": false, "entity_type": "StixFile", "id": "51cf4354-8c54-49fa-b41d-6c4f5afe9606", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--d7d0aac2-57d5-57af-a1f8-addae0db7864", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.003Z", "created_at": "2026-09-26T05:10:16.258Z", "modified": "2026-09-26T05:11:25.070Z", "updated_at": "2026-09-26T05:11:25.070Z" }, "description_available": false, "entity_type": "Indicator", "id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--4b16cf55-318d-59a8-9bf7-f4784a9ed816", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.029Z", "created_at": "2026-09-26T05:10:21.512Z", "modified": "2026-09-26T05:11:57.790Z", "updated_at": "2026-09-26T05:11:57.790Z" }, "description_available": false, "entity_type": "Indicator", "id": "5a993697-904e-47a0-aebe-678c6017a892", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--92348e93-7503-55ff-9d71-990535f93a77", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.011Z", "created_at": "2026-09-26T05:10:18.499Z", "modified": "2026-09-26T05:11:31.792Z", "updated_at": "2026-09-26T05:11:31.792Z" }, "description_available": false, "entity_type": "Indicator", "id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--53a0047f-d3ca-5130-997c-41e82501ad16", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.981Z", "created_at": "2026-09-26T05:10:09.673Z", "modified": "2026-09-26T05:10:49.456Z", "updated_at": "2026-09-26T05:10:49.456Z" }, "description_available": false, "entity_type": "Indicator", "id": "67b392c6-b5a1-4178-a868-12bfcf685900", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--c645254d-2794-5fc6-8b9d-d6fa1b4f9b04", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:38.968Z", "updated_at": "2026-09-26T05:09:39.453Z" }, "description_available": false, "entity_type": "StixFile", "id": "6843d8e1-a49b-4fa6-ada2-d1f7353c7cac", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--d04d45bb-05c5-537b-87e4-8ff0fcc47957", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:21.636Z", "updated_at": "2026-09-26T05:09:23.785Z" }, "description_available": false, "entity_type": "StixFile", "id": "69bffd21-d89a-4d19-98d6-0a6767ac49fe", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--991b3aea-7561-530c-b344-d096bad5d453", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.027Z", "created_at": "2026-09-26T05:10:21.229Z", "modified": "2026-09-26T05:11:52.973Z", "updated_at": "2026-09-26T05:11:52.973Z" }, "description_available": false, "entity_type": "Indicator", "id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--4410eabd-0a36-5998-9f3e-5824694294af", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:22.670Z", "updated_at": "2026-09-26T05:09:24.533Z" }, "description_available": false, "entity_type": "StixFile", "id": "6ebf6b4d-f515-4cb7-b60c-a1871c914225", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--64e9ba91-5a01-5a8e-9a3b-824aec82ff57", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:19.981Z", "updated_at": "2026-09-26T05:09:20.404Z" }, "description_available": false, "entity_type": "StixFile", "id": "71065c2e-0937-4a31-a098-8e6bb6e2f793", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--a47ae37c-2395-5bfb-9369-7f97aa906183", "type": "StixFile" }, { "__typename": "Malware", "aliases": [ "win.castleloader" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T18:14:28.208Z", "created_at": "2026-01-18T21:52:24.915Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-29T02:46:12.008Z", "updated_at": "2026-09-29T02:46:12.008Z" }, "description_available": true, "entity_type": "Malware", "id": "7262b430-7e06-4139-b4bc-081aae009a3c", "is_inferred": false, "labels": [ "anyrun", "as216234", "botnet_cc", "c2", "castleloader", "server-21-as" ], "lang": "en", "name": "CASTLELOADER", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "f884ddcc-c74f-4e9a-b0b7-2c3d37df6539", "source_name": "ThreatFox source reference", "url": "https://any.run/cybersecurity-blog/castleloader-malware-analysis/" }, { "external_id": null, "id": "237eac89-8a8e-4242-800b-5fb098df1e69", "source_name": "malpedia", "url": "https://blackpointcyber.com/blog/python-driven-castleloader-analysis/" }, { "external_id": null, "id": "538e990f-158a-4323-b4ed-a921a1ca1a7e", "source_name": "malpedia", "url": "https://blog.polyswarm.io/castleloader" }, { "external_id": null, "id": "fd10b1e0-950f-460e-8d46-20a0f3ed91bb", "source_name": "malpedia", "url": "https://catalyst.prodaft.com/public/report/understanding-current-castleloader-campaigns/overview" }, { "external_id": null, "id": "b7e7e61f-baf6-402c-bfed-8445838b146b", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.castleloader" }, { "external_id": null, "id": "badba975-7f4d-4943-a471-c7b9c0d06f13", "source_name": "malpedia", "url": "https://medium.com/@anyrun/castleloader-malware-overview-a44b9db666b8" }, { "external_id": null, "id": "8750d6cb-b9c7-4395-b009-053e177bce6c", "source_name": "malpedia", "url": "https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/" }, { "external_id": null, "id": "9a923cb2-d287-47a8-8bbb-217afd97b55f", "source_name": "malpedia", "url": "https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader" }, { "external_id": null, "id": "cae88bb7-48be-40fa-b483-4ce925809e86", "source_name": "malpedia", "url": "https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/" }, { "external_id": null, "id": "82cc0492-61c2-4932-85b9-6bc0b9a9d0c7", "source_name": "malpedia", "url": "https://www.ibm.com/think/x-force/dissecting-castlebot-maas-operation" }, { "external_id": null, "id": "82fc8f20-a9a8-4d7d-a8a8-b83d4c8892da", "source_name": "malpedia", "url": "https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "malware--18d53072-c328-529d-8391-fb88d90b7e1c", "type": "Malware" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:46.573Z", "updated_at": "2026-09-26T05:09:47.057Z" }, "description_available": false, "entity_type": "Hostname", "id": "75cef387-d1cc-4d5b-b81b-f2dc0fc310b3", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "hostname--76214268-b101-5709-9bc7-f28eb9345f9e", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:33.545Z", "updated_at": "2026-09-26T05:09:34.864Z" }, "description_available": false, "entity_type": "StixFile", "id": "77052f76-29d1-4ac9-a1a4-52f5b66959ce", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--fbfc71af-1c52-5357-8871-1bd9cabd3618", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:36.646Z", "updated_at": "2026-09-26T05:09:37.116Z" }, "description_available": false, "entity_type": "StixFile", "id": "79db2d01-74df-4eab-9b69-e93443b57609", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--3e7fd993-d406-5940-82e7-a31742815a71", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.000Z", "created_at": "2026-09-26T05:10:14.771Z", "modified": "2026-09-26T05:11:15.057Z", "updated_at": "2026-09-26T05:11:15.057Z" }, "description_available": false, "entity_type": "Indicator", "id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--22d66397-109f-5b04-b457-0cf9a05ff3cf", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:46.109Z", "updated_at": "2026-09-26T05:09:46.802Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "8746d110-6b23-41e6-aec2-9b189661f26d", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "domain-name--fff340a8-83a9-53cc-b5e5-ece83d6b733d", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.022Z", "created_at": "2026-09-26T05:10:20.387Z", "modified": "2026-09-30T23:10:17.730Z", "updated_at": "2026-09-30T23:10:17.730Z" }, "description_available": false, "entity_type": "Indicator", "id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--2ed210af-9f61-556a-bd34-de8e98e554d9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.985Z", "created_at": "2026-09-26T05:10:10.943Z", "modified": "2026-09-26T05:11:02.608Z", "updated_at": "2026-09-26T05:11:02.608Z" }, "description_available": false, "entity_type": "Indicator", "id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--74ae376f-1e30-5df3-a414-9d4b4b477e99", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.960Z", "created_at": "2026-09-26T05:10:07.628Z", "modified": "2026-09-26T05:10:43.964Z", "updated_at": "2026-09-26T05:10:43.964Z" }, "description_available": false, "entity_type": "Indicator", "id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--49c7f198-c05c-5f29-944f-ade15a2ba6d9", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:48.116Z", "updated_at": "2026-09-26T05:09:48.414Z" }, "description_available": false, "entity_type": "Hostname", "id": "a08bb6c7-8406-40f1-9e45-506b22353672", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "hostname--f7cb142c-2363-509f-b748-93e7a9dab276", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:36.341Z", "updated_at": "2026-09-26T05:09:36.699Z" }, "description_available": false, "entity_type": "StixFile", "id": "a1d8b01b-a784-4961-adcb-fb07daec2314", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--09853966-1b43-5c5e-9b6e-d98ad9ce3300", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:41.309Z", "updated_at": "2026-09-26T05:09:43.821Z" }, "description_available": false, "entity_type": "StixFile", "id": "a2ae5fe6-eeab-4d4b-b30a-3726ff538020", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--8d72933e-19b1-5151-8a76-683a95289076", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:46.066Z", "updated_at": "2026-09-26T05:09:46.539Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "a5cced2a-e515-4c59-b9c0-1b39b10efc73", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "domain-name--0fa352a9-f215-5886-a874-788ed2196772", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:41.584Z", "updated_at": "2026-09-26T05:09:43.822Z" }, "description_available": false, "entity_type": "StixFile", "id": "a6443bde-0ee5-47b9-8a23-e81726562c85", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--56b6c599-9a33-5644-81de-517100040a28", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.971Z", "created_at": "2026-09-26T05:10:09.674Z", "modified": "2026-09-26T05:10:52.389Z", "updated_at": "2026-09-26T05:10:52.389Z" }, "description_available": false, "entity_type": "Indicator", "id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--4d9479c8-f821-55c8-8c98-1505fdb7feb8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.951Z", "created_at": "2026-09-26T05:10:01.706Z", "modified": "2026-09-26T05:10:35.193Z", "updated_at": "2026-09-26T05:10:35.193Z" }, "description_available": false, "entity_type": "Indicator", "id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--1f2f644d-90b1-5165-ab9a-e2f417273ae9", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:44.912Z", "updated_at": "2026-09-26T05:09:45.350Z" }, "description_available": false, "entity_type": "StixFile", "id": "b19e04aa-4778-40f6-9884-f90108d08025", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--86d59aee-6944-5fa8-aa34-20c491acebc0", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.019Z", "created_at": "2026-09-26T05:10:20.035Z", "modified": "2026-09-26T05:11:45.552Z", "updated_at": "2026-09-26T05:11:45.552Z" }, "description_available": false, "entity_type": "Indicator", "id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--ef286325-6127-548b-92bc-a82ce53f0dfc", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:18.945Z", "updated_at": "2026-09-26T05:09:19.598Z" }, "description_available": false, "entity_type": "StixFile", "id": "b4a870c9-9bc1-4844-be61-54eb9fe1f586", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--49e0b81e-4556-5c88-a014-cb03a344ebc8", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:33:43.143Z", "created_at": "2026-08-10T19:23:43.975Z", "modified": "2026-09-26T05:09:48.975Z", "updated_at": "2026-09-26T05:09:48.975Z" }, "description_available": false, "entity_type": "Indicator", "id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "is_inferred": false, "labels": [ "boryptgrab", "browser extension", "castleloader", "castlerat", "castlestealer", "certificate pinning", "clickfix", "cryptocurrency theft", "etherhiding", "indirect syscalls", "ironpython", "lobshot", "needlestealer", "netsupport rat", "polygon", "powershell", "powershell stager", "pythonrat", "ransomware", "sloppyrat", "wallet spoofer" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--1ffcf8e3-921b-5c8e-94b0-4b9072550292", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:37.766Z", "updated_at": "2026-09-26T05:09:38.284Z" }, "description_available": false, "entity_type": "StixFile", "id": "b8312c24-f868-490b-89e0-553fed502b7b", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--5502928d-1019-5425-b537-8f4f7347a7c9", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:34.648Z", "updated_at": "2026-09-26T05:09:35.513Z" }, "description_available": false, "entity_type": "StixFile", "id": "b9bcc399-952b-456c-a528-64b89702f110", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--463a4a4b-1df2-5106-ab17-c3908bd5c89e", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:38.658Z", "updated_at": "2026-09-26T05:09:39.292Z" }, "description_available": false, "entity_type": "StixFile", "id": "bd16419d-d64f-413d-8759-4ddd8bbce584", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--34900c08-738e-5b47-8cd8-65f3a12c4b02", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.924Z", "created_at": "2026-09-26T05:09:48.244Z", "modified": "2026-09-26T05:09:54.705Z", "updated_at": "2026-09-26T05:09:54.705Z" }, "description_available": false, "entity_type": "Indicator", "id": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--3b4906b4-2423-51a8-8356-f445e83b981f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.943Z", "created_at": "2026-09-26T05:09:57.721Z", "modified": "2026-09-26T05:10:20.217Z", "updated_at": "2026-09-26T05:10:20.217Z" }, "description_available": false, "entity_type": "Indicator", "id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--978fd60c-aa94-5b03-82c1-c2a0569fbae9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.014Z", "created_at": "2026-09-26T05:10:18.506Z", "modified": "2026-09-26T05:11:41.329Z", "updated_at": "2026-09-26T05:11:41.329Z" }, "description_available": false, "entity_type": "Indicator", "id": "ca745501-93e4-4222-a598-ca408b75ff32", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--312202fc-9bf0-5faa-9682-5974de2eadfb", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.945Z", "created_at": "2026-09-26T05:09:57.720Z", "modified": "2026-09-26T05:10:25.405Z", "updated_at": "2026-09-26T05:10:25.405Z" }, "description_available": false, "entity_type": "Indicator", "id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--3bba6381-aee9-5fbc-bf2b-177e97d89da4", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.988Z", "created_at": "2026-09-26T05:10:12.310Z", "modified": "2026-09-26T05:11:04.460Z", "updated_at": "2026-09-26T05:11:04.460Z" }, "description_available": false, "entity_type": "Indicator", "id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--e376598f-e932-5c58-a00d-ac6c33b4c02e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.948Z", "created_at": "2026-09-26T05:09:59.690Z", "modified": "2026-09-26T05:10:26.399Z", "updated_at": "2026-09-26T05:10:26.399Z" }, "description_available": false, "entity_type": "Indicator", "id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--86acf3a4-40c6-50b1-a7e1-dcbc0651106b", "type": "Indicator" }, { "__typename": "Malware", "aliases": [ "CastleRAT", "win.nightshade_c2" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T19:09:17.650Z", "created_at": "2026-01-18T21:18:09.509Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:14:15.364Z", "updated_at": "2026-10-07T03:14:15.364Z" }, "description_available": true, "entity_type": "Malware", "id": "d9bacd37-b311-4282-86f5-690679adc49e", "is_inferred": false, "labels": [ "botnet_cc", "castlerat", "rat" ], "lang": "en", "name": "NightshadeC2", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "6bcf9dd7-31a4-440c-8373-18cdcae5a763", "source_name": "malpedia", "url": "https://blog.deception.pro/blog/castlerat-dec2025-hok-ato" }, { "external_id": null, "id": "d546ad02-529a-42d5-8fd6-d9d602dc860c", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightshade_c2" }, { "external_id": null, "id": "ead7ba18-8f07-499f-ab84-181391d26f3b", "source_name": "malpedia", "url": "https://www.esentire.com/blog/new-botnet-emerges-from-the-shadows-nightshadec2" }, { "external_id": null, "id": "82cc0492-61c2-4932-85b9-6bc0b9a9d0c7", "source_name": "malpedia", "url": "https://www.ibm.com/think/x-force/dissecting-castlebot-maas-operation" }, { "external_id": null, "id": "cc9b7120-9c6d-4031-81e0-683ccf2122f3", "source_name": "malpedia", "url": "https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations" }, { "external_id": null, "id": "82fc8f20-a9a8-4d7d-a8a8-b83d4c8892da", "source_name": "malpedia", "url": "https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "malware--7e57c5ab-9e96-5975-b40b-23cf3bd6d88e", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:44.780Z", "updated_at": "2026-09-26T05:09:45.041Z" }, "description_available": false, "entity_type": "StixFile", "id": "da6c7da2-cb8d-4e60-9db0-b9a375f38d1e", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--22775452-8c38-5526-8d49-22441d8dd9d0", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.997Z", "created_at": "2026-09-26T05:10:14.777Z", "modified": "2026-09-26T05:11:20.676Z", "updated_at": "2026-09-26T05:11:20.676Z" }, "description_available": false, "entity_type": "Indicator", "id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--48c0bc0f-64b0-54d6-abd5-29b860c1c69b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.929Z", "created_at": "2026-09-26T05:09:49.696Z", "modified": "2026-09-26T05:09:56.429Z", "updated_at": "2026-09-26T05:09:56.429Z" }, "description_available": false, "entity_type": "Indicator", "id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--fe06647c-1e04-59ab-8d17-ff43e61d7d7b", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:31.967Z", "updated_at": "2026-09-26T05:09:32.692Z" }, "description_available": false, "entity_type": "StixFile", "id": "e4fd9ea3-1145-49e0-ab34-ff2ea041bee2", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--73716516-eedd-5db8-bf8f-1457b1b7c360", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.024Z", "created_at": "2026-09-26T05:10:20.493Z", "modified": "2026-09-26T05:11:51.074Z", "updated_at": "2026-09-26T05:11:51.074Z" }, "description_available": false, "entity_type": "Indicator", "id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--004fd62e-510e-5a21-b5b6-160aea9a72c7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.968Z", "created_at": "2026-09-26T05:10:07.764Z", "modified": "2026-09-26T05:10:46.659Z", "updated_at": "2026-09-26T05:10:46.659Z" }, "description_available": false, "entity_type": "Indicator", "id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--ac33a275-8837-5d5a-b390-80714faabbbb", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.934Z", "created_at": "2026-09-26T05:09:55.486Z", "modified": "2026-09-26T05:10:14.987Z", "updated_at": "2026-09-26T05:10:14.987Z" }, "description_available": false, "entity_type": "Indicator", "id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--bce310cf-37c3-5aa4-9bbb-7868b8453e13", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-10T19:21:52.097Z", "updated_at": "2026-09-26T05:09:18.827Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "eb194e16-42d9-414f-a726-b1565b8243aa", "is_inferred": false, "labels": [ "boryptgrab", "browser extension", "castleloader", "castlerat", "castlestealer", "certificate pinning", "clickfix", "cryptocurrency theft", "etherhiding", "indirect syscalls", "ironpython", "lobshot", "needlestealer", "netsupport rat", "polygon", "powershell", "powershell stager", "pythonrat", "ransomware", "sloppyrat", "wallet spoofer" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "domain-name--dd7ad183-6e18-51a0-a4b3-55bdc3e74b99", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:25.526Z", "updated_at": "2026-09-26T05:09:26.229Z" }, "description_available": false, "entity_type": "StixFile", "id": "ed6887d7-db22-44b5-b43d-6db3fe55f377", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--e1baa3b0-6d7c-5bca-9201-b2547b3878d9", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.927Z", "created_at": "2026-09-26T05:09:49.225Z", "modified": "2026-09-26T05:09:51.470Z", "updated_at": "2026-09-26T05:09:51.470Z" }, "description_available": false, "entity_type": "Indicator", "id": "ef46b969-b83c-42f6-9399-70267f990d7d", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--1f2977c3-6b20-5f60-9e35-552dd4667d02", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.975Z", "created_at": "2026-09-26T05:10:09.682Z", "modified": "2026-09-26T05:10:56.720Z", "updated_at": "2026-09-26T05:10:56.720Z" }, "description_available": false, "entity_type": "Indicator", "id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--6a7f491f-e2e9-5e73-bcdb-da8db41fecfd", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:25.518Z", "updated_at": "2026-09-26T05:09:26.173Z" }, "description_available": false, "entity_type": "StixFile", "id": "f888710c-f66e-4890-85cb-f4c46c76f1ce", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--2654b732-0386-5728-b9a1-0c6be6e33647", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:20.461Z", "updated_at": "2026-09-26T05:09:20.888Z" }, "description_available": false, "entity_type": "StixFile", "id": "f97dfd6c-e384-4e65-a42a-71e5fe6c5614", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--48e5aee6-b42c-5162-93c0-c9784bc41680", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.872Z", "created_at": "2026-09-26T05:09:12.244Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T05:09:12.784Z", "updated_at": "2026-09-26T05:09:12.784Z" }, "description_available": false, "entity_type": "Malware", "id": "f98918ea-513a-4435-960c-de289dc50d7b", "is_inferred": false, "labels": [], "lang": "en", "name": "SloppyRAT", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "malware--a282aea0-4194-5540-badb-1538514bc158", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:38.578Z", "updated_at": "2026-09-26T05:09:38.923Z" }, "description_available": false, "entity_type": "StixFile", "id": "fac83473-b628-4ed1-b62e-43707b122172", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--7a57979f-99fa-52fd-be7f-69782ac222a5", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.963Z", "created_at": "2026-09-26T05:10:07.760Z", "modified": "2026-09-26T05:10:40.124Z", "updated_at": "2026-09-26T05:10:40.124Z" }, "description_available": false, "entity_type": "Indicator", "id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "indicator--d53a3e77-f306-5d18-bbb4-fecb2b0b3f48", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:09:34.644Z", "updated_at": "2026-09-26T05:09:35.223Z" }, "description_available": false, "entity_type": "StixFile", "id": "fb6717f7-eabc-4ba6-98ab-93c34f0dc16a", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "file--d9ee05d9-cafd-5af8-a230-cda525353e24", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.150Z", "created_at": "2026-09-26T05:14:55.497Z", "modified": "2026-09-26T05:14:55.786Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:55.786Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_name": null, "from_type": "Indicator", "id": "01eb7d1c-7c84-487a-84e1-ee548bef6f1e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--150cd9a0-b0d3-550d-930a-cf6a5cc3a7a0", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.453Z", "created_at": "2026-09-26T05:21:44.374Z", "modified": "2026-09-26T05:21:44.538Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:44.538Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_name": null, "from_type": "Indicator", "id": "02247229-3e0f-4db0-8e5e-25c714967480", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--725d6308-f088-50cb-a2d1-f662485cf46f", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.251Z", "created_at": "2026-09-26T05:16:52.900Z", "modified": "2026-09-26T05:16:53.129Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:53.129Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_name": null, "from_type": "Indicator", "id": "025755dc-d912-4ce7-a6e4-6ebd80c668a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--24d42cbd-ff1e-5c71-b9d9-07c7e5cbf485", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.300Z", "created_at": "2026-09-26T05:17:51.329Z", "modified": "2026-09-26T05:17:51.669Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:51.669Z" }, "description_available": false, "entity_type": "indicates", "fromId": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_name": null, "from_type": "Indicator", "id": "035afc98-2958-4900-a7e1-93c5ea52f131", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--974d7d93-68e7-57b3-94b4-e814728c996d", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.390Z", "created_at": "2026-09-26T05:20:37.271Z", "modified": "2026-09-26T05:20:38.061Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:38.061Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_name": null, "from_type": "Indicator", "id": "08469b10-bf3f-4cff-a667-7a34564a13a3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2349019c-15b5-5c87-93bd-b9fb38e7c0db", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.026Z", "created_at": "2026-09-26T05:11:56.704Z", "modified": "2026-09-26T05:11:57.875Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:57.875Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_name": null, "from_type": "Indicator", "id": "0afcb9e4-3fb7-41a3-b81c-e3f5d6560d90", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--97b026d7-6f69-5402-a352-a0ed1688c369", "toId": "a5cced2a-e515-4c59-b9c0-1b39b10efc73", "to_id": "a5cced2a-e515-4c59-b9c0-1b39b10efc73", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.127Z", "created_at": "2026-09-26T05:14:28.191Z", "modified": "2026-09-26T05:14:28.521Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:28.521Z" }, "description_available": false, "entity_type": "indicates", "fromId": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_name": null, "from_type": "Indicator", "id": "0c4e7e7c-837a-498f-a2bd-0dcef89122db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e7a465b4-34a9-5232-94f1-b1b761717f8a", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.010Z", "created_at": "2026-09-26T05:11:52.674Z", "modified": "2026-09-26T05:11:52.995Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:52.995Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_name": null, "from_type": "Indicator", "id": "0cbde6cd-17cc-43a3-b9c5-9d10da655fcd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--cfb57dc2-7ded-5259-a0eb-fd49badafc12", "toId": "51cf4354-8c54-49fa-b41d-6c4f5afe9606", "to_id": "51cf4354-8c54-49fa-b41d-6c4f5afe9606", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.989Z", "created_at": "2026-09-26T05:11:50.104Z", "modified": "2026-09-26T05:11:50.720Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:50.720Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_name": null, "from_type": "Indicator", "id": "0d2f6b55-905b-43f3-a2bf-cb21bd12b4ca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1264c84e-f0f7-5934-ba8f-bbd4aba6c933", "toId": "4af466a5-997d-4c29-99cb-556abd9cc955", "to_id": "4af466a5-997d-4c29-99cb-556abd9cc955", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.947Z", "created_at": "2026-09-26T05:11:38.892Z", "modified": "2026-09-26T05:11:39.722Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:39.722Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_name": null, "from_type": "Indicator", "id": "0eab1abb-12e4-4e5b-89bc-a7e1f278d3f8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ff65b56b-1cc0-54ee-97da-6c55fe1b2afd", "toId": "f888710c-f66e-4890-85cb-f4c46c76f1ce", "to_id": "f888710c-f66e-4890-85cb-f4c46c76f1ce", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.127Z", "created_at": "2026-09-26T05:14:34.922Z", "modified": "2026-09-26T05:14:35.181Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:35.181Z" }, "description_available": false, "entity_type": "indicates", "fromId": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_name": null, "from_type": "Indicator", "id": "0f342123-64b6-4d19-8599-49d829357f74", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--154bd909-0e72-57a0-b3c9-1b5a55f42161", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.152Z", "created_at": "2026-09-26T05:14:56.056Z", "modified": "2026-09-26T05:14:56.331Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:56.331Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_name": null, "from_type": "Indicator", "id": "0f39b9e1-bf9c-49c0-bdd1-29bfa4a116eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--8fd326eb-09ee-5ed8-b919-c20971cb5b88", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.944Z", "created_at": "2026-09-26T05:11:37.359Z", "modified": "2026-09-26T05:11:38.395Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:38.395Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_name": null, "from_type": "Indicator", "id": "0ff25aef-e1ed-4870-b361-08a98b31796a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9e09e092-616d-5973-86d5-427e872377ac", "toId": "6ebf6b4d-f515-4cb7-b60c-a1871c914225", "to_id": "6ebf6b4d-f515-4cb7-b60c-a1871c914225", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.226Z", "created_at": "2026-09-26T05:16:19.929Z", "modified": "2026-09-26T05:16:20.041Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:20.041Z" }, "description_available": false, "entity_type": "indicates", "fromId": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_name": null, "from_type": "Indicator", "id": "10f2b5bf-afce-41ef-b4b9-13512dcd408f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--5bf8ce95-4725-54b2-a83f-6b0a2e7363f1", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.227Z", "created_at": "2026-09-26T05:16:24.774Z", "modified": "2026-09-26T05:16:24.985Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:24.985Z" }, "description_available": false, "entity_type": "indicates", "fromId": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_name": null, "from_type": "Indicator", "id": "1462f45a-44f3-4fc4-9290-8c2c8af3b9f8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--41035c6a-79b4-58fb-9e95-67cc367181bf", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.324Z", "created_at": "2026-09-26T05:18:21.090Z", "modified": "2026-09-26T05:18:21.394Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:18:21.394Z" }, "description_available": false, "entity_type": "indicates", "fromId": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_id": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_name": null, "from_type": "Indicator", "id": "17e36cdb-782c-4ae2-ac85-b4ec02819b13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2868c296-f61e-5a0c-9982-cd487e058046", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.188Z", "created_at": "2026-09-26T05:15:41.063Z", "modified": "2026-09-26T05:15:41.258Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:41.258Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_name": null, "from_type": "Indicator", "id": "1986fb71-a978-43a3-a3a2-bcc10b28c5c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c950f2df-a874-5979-9be5-cbdf68b32f50", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.416Z", "created_at": "2026-09-26T05:21:02.948Z", "modified": "2026-09-26T05:21:03.103Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:03.103Z" }, "description_available": false, "entity_type": "indicates", "fromId": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_name": null, "from_type": "Indicator", "id": "19e1ebe6-29cd-4667-a2cd-da665f3d8d51", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--5c6eabd2-47c3-5f93-a82a-c65c0574b604", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.933Z", "created_at": "2026-09-26T05:11:33.797Z", "modified": "2026-09-26T05:11:35.137Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:35.137Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_name": null, "from_type": "Indicator", "id": "1c7475e9-38a6-4d02-becb-2e207fce9bea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--3e4e089f-a7f1-5cb4-b1e3-107ced375994", "toId": "71065c2e-0937-4a31-a098-8e6bb6e2f793", "to_id": "71065c2e-0937-4a31-a098-8e6bb6e2f793", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.288Z", "created_at": "2026-09-26T05:17:38.154Z", "modified": "2026-09-26T05:17:38.416Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:38.416Z" }, "description_available": false, "entity_type": "indicates", "fromId": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_id": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_name": null, "from_type": "Indicator", "id": "1ce55c69-05b9-4870-976a-04457050f875", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--7861b399-b70f-5b08-9d27-b44aa5be9edd", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.468Z", "created_at": "2026-09-26T05:22:00.827Z", "modified": "2026-09-26T05:22:01.039Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:01.039Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_name": null, "from_type": "Indicator", "id": "1e2523cd-9416-42ad-8adb-465e232079bd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2d2326f6-f5af-5553-882a-f18e10eb8816", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.164Z", "created_at": "2026-09-26T05:15:11.129Z", "modified": "2026-09-26T05:15:12.138Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:12.138Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_name": null, "from_type": "Indicator", "id": "1e7bc65a-0e3e-4de6-b45d-c3d4d0deaa52", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--329b1102-0ac9-552d-a81e-1a3809247fa2", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.441Z", "created_at": "2026-09-26T05:21:28.871Z", "modified": "2026-09-26T05:21:29.061Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:29.061Z" }, "description_available": false, "entity_type": "indicates", "fromId": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_id": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_name": null, "from_type": "Indicator", "id": "1f86ebc2-f4ef-40ad-9b0d-0617daaa4870", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c14c1349-9d54-5e6e-920e-974a67b43469", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.239Z", "created_at": "2026-09-26T05:16:35.670Z", "modified": "2026-09-26T05:16:36.377Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:36.377Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_name": null, "from_type": "Indicator", "id": "1fd5d852-d6f7-46d4-ac97-e79673e71e1f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--cc89d09e-c92e-5050-993b-14d34e93b1d4", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.983Z", "created_at": "2026-09-26T05:11:46.853Z", "modified": "2026-09-26T05:11:49.297Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:49.297Z" }, "description_available": false, "entity_type": "based-on", "fromId": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_id": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_name": null, "from_type": "Indicator", "id": "25d776df-bde4-4c3a-b3d6-c6adabc502ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--84e43d76-eaa3-5dc9-aab4-6a5e61cfe874", "toId": "fb6717f7-eabc-4ba6-98ab-93c34f0dc16a", "to_id": "fb6717f7-eabc-4ba6-98ab-93c34f0dc16a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.961Z", "created_at": "2026-09-26T05:11:41.711Z", "modified": "2026-09-26T05:11:42.365Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:42.365Z" }, "description_available": false, "entity_type": "based-on", "fromId": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_name": null, "from_type": "Indicator", "id": "275be246-9ea5-4fff-99a0-a843b375edb3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c5b16d90-0977-5ebf-8302-7ad83519f349", "toId": "012048cb-cb41-4202-8038-3a077ce64694", "to_id": "012048cb-cb41-4202-8038-3a077ce64694", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.015Z", "created_at": "2026-09-26T05:11:53.354Z", "modified": "2026-09-26T05:11:53.804Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:53.804Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ca745501-93e4-4222-a598-ca408b75ff32", "from_id": "ca745501-93e4-4222-a598-ca408b75ff32", "from_name": null, "from_type": "Indicator", "id": "293e8dd5-1ba1-4cdc-a8e2-5ae6761d1d60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b1b81c77-0361-5ccc-a54e-46a923166b92", "toId": "a6443bde-0ee5-47b9-8a23-e81726562c85", "to_id": "a6443bde-0ee5-47b9-8a23-e81726562c85", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.970Z", "created_at": "2026-09-26T05:11:45.331Z", "modified": "2026-09-26T05:11:45.959Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:45.959Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_name": null, "from_type": "Indicator", "id": "29452afe-8b2c-4d67-8677-7df59a4f1b87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--58b0b28f-bf4d-5560-93e4-fc188fb37823", "toId": "4afcdf19-5bd9-4d3e-b031-75bd248f024e", "to_id": "4afcdf19-5bd9-4d3e-b031-75bd248f024e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.002Z", "created_at": "2026-09-26T05:11:51.491Z", "modified": "2026-09-26T05:11:52.093Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:52.093Z" }, "description_available": false, "entity_type": "based-on", "fromId": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_name": null, "from_type": "Indicator", "id": "29cff5ba-ac67-4c21-8af8-be79d8984af6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--5137e680-dc8e-51b0-beb7-0b637b3f50d3", "toId": "fac83473-b628-4ed1-b62e-43707b122172", "to_id": "fac83473-b628-4ed1-b62e-43707b122172", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.453Z", "created_at": "2026-09-26T05:21:44.839Z", "modified": "2026-09-26T05:21:45.095Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:45.095Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_name": null, "from_type": "Indicator", "id": "2d731c83-888b-48d6-ac1b-72d97c776566", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--db0edd68-ed58-54f9-adf5-8e015fa6f5f7", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.301Z", "created_at": "2026-09-26T05:18:00.386Z", "modified": "2026-09-26T05:18:00.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:18:00.613Z" }, "description_available": false, "entity_type": "indicates", "fromId": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_name": null, "from_type": "Indicator", "id": "343c487a-5a67-41bc-92ca-a3b38d9e5795", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9684342f-4478-586f-a7fb-ca111ca67326", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:33:43.145Z", "created_at": "2026-08-10T19:30:45.997Z", "modified": "2026-08-10T19:30:47.949Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-10T19:30:47.949Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_name": null, "from_type": "Indicator", "id": "3472caa9-8ba5-4336-a1c5-717dd91981e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--f824e8d1-334a-5211-b504-4db1d12c766a", "toId": "eb194e16-42d9-414f-a726-b1565b8243aa", "to_id": "eb194e16-42d9-414f-a726-b1565b8243aa", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.005Z", "created_at": "2026-09-26T05:11:51.558Z", "modified": "2026-09-26T05:11:52.092Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:52.092Z" }, "description_available": false, "entity_type": "based-on", "fromId": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_name": null, "from_type": "Indicator", "id": "348e17a0-a170-4b0c-ac4d-5af30b58a4ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--73aa59ce-967b-588b-b3a4-df404fd5a1f2", "toId": "bd16419d-d64f-413d-8759-4ddd8bbce584", "to_id": "bd16419d-d64f-413d-8759-4ddd8bbce584", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.176Z", "created_at": "2026-09-26T05:15:24.489Z", "modified": "2026-09-26T05:15:24.777Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:24.777Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_name": null, "from_type": "Indicator", "id": "36299783-e578-407d-b551-c6784ce6e2f1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--427c23eb-e657-5825-9a7c-a1c331489407", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.978Z", "created_at": "2026-09-26T05:11:46.329Z", "modified": "2026-09-26T05:11:49.249Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:49.249Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_name": null, "from_type": "Indicator", "id": "36801e9b-45f1-442a-a3c4-7e6484b4d0b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--37c1ce21-c593-58f9-ab08-c32a5abdb0bc", "toId": "77052f76-29d1-4ac9-a1a4-52f5b66959ce", "to_id": "77052f76-29d1-4ac9-a1a4-52f5b66959ce", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.429Z", "created_at": "2026-09-26T05:21:16.264Z", "modified": "2026-09-26T05:21:16.459Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:16.459Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca745501-93e4-4222-a598-ca408b75ff32", "from_id": "ca745501-93e4-4222-a598-ca408b75ff32", "from_name": null, "from_type": "Indicator", "id": "369dee90-7d96-4e63-8526-d4c42f82604a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--f0527adf-cf90-5b05-bfc0-dcd2258f545a", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.480Z", "created_at": "2026-09-26T05:22:17.574Z", "modified": "2026-09-26T05:22:17.856Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:17.856Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_name": null, "from_type": "Indicator", "id": "36bed62b-a7b7-49f0-97f0-374f37257ce0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d4b094e9-d921-518c-ab1f-3d0eabcdd5aa", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.059Z", "created_at": "2026-09-26T05:13:28.165Z", "modified": "2026-09-26T05:13:28.591Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:28.591Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_id": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_name": null, "from_type": "Indicator", "id": "3c283e18-8789-45d8-b36d-3720846aa64e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--731a700e-91c4-56d7-bcbe-023565cdcdd8", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.034Z", "created_at": "2026-09-26T05:11:59.705Z", "modified": "2026-09-26T05:11:59.933Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:59.933Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_name": null, "from_type": "Indicator", "id": "41949149-2a3c-4aaa-b9bf-ac40fa28c312", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e175ff63-edf2-59bb-af67-4062c23bae8d", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.986Z", "created_at": "2026-09-26T05:11:49.321Z", "modified": "2026-09-26T05:11:50.010Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:50.010Z" }, "description_available": false, "entity_type": "based-on", "fromId": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_name": null, "from_type": "Indicator", "id": "466b3a39-ba55-4a75-9a8f-2edbdc0f277b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ff34d5bd-80c8-53e4-96c4-ea9fbde8db1d", "toId": "b9bcc399-952b-456c-a528-64b89702f110", "to_id": "b9bcc399-952b-456c-a528-64b89702f110", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.363Z", "created_at": "2026-09-26T05:20:11.386Z", "modified": "2026-09-26T05:20:12.311Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:12.311Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_name": null, "from_type": "Indicator", "id": "46b91825-f776-4411-a0bf-bf61b31c8889", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--24c1a737-f5d8-5e3a-b352-c29620e7908f", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.263Z", "created_at": "2026-09-26T05:17:18.147Z", "modified": "2026-09-26T05:17:18.370Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:18.370Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_name": null, "from_type": "Indicator", "id": "47492aea-ec73-48ab-8a24-0d2a6586e77e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--efcc35c3-04fa-5050-b7d8-786e5d988b3c", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.202Z", "created_at": "2026-09-26T05:15:57.103Z", "modified": "2026-09-26T05:15:57.302Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:57.302Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_name": null, "from_type": "Indicator", "id": "4ae8ef39-b4e1-43f0-a0c0-af264498b0ab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d13f8dd2-38c9-5a0d-8107-52bc826726c1", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.164Z", "created_at": "2026-09-26T05:15:15.180Z", "modified": "2026-09-26T05:15:15.426Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:15.426Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_name": null, "from_type": "Indicator", "id": "4c3518e9-27c4-4724-ad7a-504206ef1a12", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a777a912-0abb-5312-94bd-29d7a2afee00", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.251Z", "created_at": "2026-09-26T05:16:53.650Z", "modified": "2026-09-26T05:16:54.068Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:54.068Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_name": null, "from_type": "Indicator", "id": "4f27c931-ac7c-4d7c-8661-411290679f62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--55bac1bf-9f44-5c87-aef9-9f1de24b9c55", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.201Z", "created_at": "2026-09-26T05:15:54.583Z", "modified": "2026-09-26T05:15:54.809Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:54.809Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_name": null, "from_type": "Indicator", "id": "4fb79e67-90bb-41c0-b814-82602fee6ca6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--081b8a38-7ab7-5f6a-ac16-880e3575fb3d", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.008Z", "created_at": "2026-09-26T05:11:52.318Z", "modified": "2026-09-26T05:11:52.732Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:52.732Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_name": null, "from_type": "Indicator", "id": "529a55f8-c5b7-4146-b698-5dbb350f5c9e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2f476e3b-c2b4-5321-9f57-f6e687d7cf73", "toId": "6843d8e1-a49b-4fa6-ada2-d1f7353c7cac", "to_id": "6843d8e1-a49b-4fa6-ada2-d1f7353c7cac", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.480Z", "created_at": "2026-09-26T05:22:18.427Z", "modified": "2026-09-26T05:22:18.708Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:18.708Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_name": null, "from_type": "Indicator", "id": "5302e289-5a44-4268-9d53-a0b7209ab774", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d1786951-72a7-5ea5-88ec-ef071d3db8be", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.018Z", "created_at": "2026-09-26T05:11:53.683Z", "modified": "2026-09-26T05:11:53.982Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:53.982Z" }, "description_available": false, "entity_type": "based-on", "fromId": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_id": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_name": null, "from_type": "Indicator", "id": "5431a7bd-4dce-47c3-8fa5-821779f3399c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a111c33e-6f6b-53be-b565-bdc64c910243", "toId": "da6c7da2-cb8d-4e60-9db0-b9a375f38d1e", "to_id": "da6c7da2-cb8d-4e60-9db0-b9a375f38d1e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.505Z", "created_at": "2026-09-26T05:22:48.172Z", "modified": "2026-09-26T05:22:48.338Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:48.338Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5a993697-904e-47a0-aebe-678c6017a892", "from_id": "5a993697-904e-47a0-aebe-678c6017a892", "from_name": null, "from_type": "Indicator", "id": "56310ba5-c0fc-4cfe-97dc-6aa74f3c6603", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--30606649-29f3-5bcc-a622-e70e4c9cc178", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.071Z", "created_at": "2026-09-26T05:13:47.130Z", "modified": "2026-09-26T05:13:47.471Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:47.471Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_name": null, "from_type": "Indicator", "id": "5aed912c-6033-4335-a1d1-f20cae316774", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--991b9682-23a4-538c-b6d1-97d20bfc1590", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.928Z", "created_at": "2026-09-26T05:11:27.451Z", "modified": "2026-09-26T05:11:29.991Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:29.991Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_id": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_name": null, "from_type": "Indicator", "id": "5b617628-a2ad-463a-bbe8-fdab2d89b2ae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e52dd803-5621-598f-8979-a98fed0c180e", "toId": "b4a870c9-9bc1-4844-be61-54eb9fe1f586", "to_id": "b4a870c9-9bc1-4844-be61-54eb9fe1f586", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.325Z", "created_at": "2026-09-26T05:18:21.671Z", "modified": "2026-09-26T05:18:21.999Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:18:21.999Z" }, "description_available": false, "entity_type": "indicates", "fromId": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_id": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_name": null, "from_type": "Indicator", "id": "5c23a1ff-8e85-4f73-9de9-473a86130243", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ad4b0c56-6b6e-5157-8bed-99c9df210576", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.481Z", "created_at": "2026-09-26T05:22:26.582Z", "modified": "2026-09-26T05:22:26.833Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:26.833Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "from_name": null, "from_type": "Indicator", "id": "5c48602d-d84c-475c-bcd3-74a95c39b472", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--295f1df3-a5e3-544a-97fd-f73bdd6586e9", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.313Z", "created_at": "2026-09-26T05:18:05.371Z", "modified": "2026-09-26T05:18:05.588Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:18:05.588Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_name": null, "from_type": "Indicator", "id": "5ca6d5a1-4d32-4757-8cbf-c033b047fe60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a65ca738-c4e5-5671-84f0-25e4205ea3aa", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.442Z", "created_at": "2026-09-26T05:21:44.429Z", "modified": "2026-09-26T05:21:44.646Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:44.646Z" }, "description_available": false, "entity_type": "indicates", "fromId": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_id": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_name": null, "from_type": "Indicator", "id": "5de6834d-1e21-4e37-9a51-d4454200f9be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1ddf8091-5ebb-5525-8ef4-18adc21c5618", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.468Z", "created_at": "2026-09-26T05:22:01.389Z", "modified": "2026-09-26T05:22:01.675Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:01.675Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_name": null, "from_type": "Indicator", "id": "5e038102-fed2-43a5-9c9e-9a4364528ef3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--fe33bbc4-8d98-5701-b96f-965d6eb02971", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.993Z", "created_at": "2026-09-26T05:11:50.083Z", "modified": "2026-09-26T05:11:50.721Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:50.721Z" }, "description_available": false, "entity_type": "based-on", "fromId": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_id": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_name": null, "from_type": "Indicator", "id": "60576ab4-4fc7-4e9e-8b98-f70c09986613", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--7adba467-4767-5689-9881-75e4fa10aa7d", "toId": "a1d8b01b-a784-4961-adcb-fb07daec2314", "to_id": "a1d8b01b-a784-4961-adcb-fb07daec2314", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.376Z", "created_at": "2026-09-26T05:20:18.374Z", "modified": "2026-09-26T05:20:18.725Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:18.725Z" }, "description_available": false, "entity_type": "indicates", "fromId": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_name": null, "from_type": "Indicator", "id": "62f9352f-8cd6-4e55-b65e-a99f5165f010", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--21f7ac64-a18d-5dc9-b810-b87af87ac056", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.376Z", "created_at": "2026-09-26T05:20:16.736Z", "modified": "2026-09-26T05:20:17.524Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:17.524Z" }, "description_available": false, "entity_type": "indicates", "fromId": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_name": null, "from_type": "Indicator", "id": "67a49247-ea9b-441a-ba02-87d9b39f05ef", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9a17763d-2df4-593e-8eb8-3f8c4cf78b99", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.139Z", "created_at": "2026-09-26T05:14:45.308Z", "modified": "2026-09-26T05:14:45.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:45.613Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_name": null, "from_type": "Indicator", "id": "682d3bf4-8049-410f-a06f-1db0e8904afc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1cba8c66-2e6a-5e02-a795-515ad2078019", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.300Z", "created_at": "2026-09-26T05:17:52.119Z", "modified": "2026-09-26T05:17:52.433Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:52.433Z" }, "description_available": false, "entity_type": "indicates", "fromId": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "from_name": null, "from_type": "Indicator", "id": "68b71f50-e6d2-4bc3-a89a-6b7efd444605", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c8bacd2d-14f7-525e-8a2d-73e6e0e788dc", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.288Z", "created_at": "2026-09-26T05:17:40.327Z", "modified": "2026-09-26T05:17:40.515Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:40.515Z" }, "description_available": false, "entity_type": "indicates", "fromId": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_id": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_name": null, "from_type": "Indicator", "id": "70f694ae-d991-4c26-a44b-a4fdcf5f24d1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9e004a7c-3a92-5aec-ac10-a785cfffd93a", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.177Z", "created_at": "2026-09-26T05:15:25.240Z", "modified": "2026-09-26T05:15:25.806Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:25.806Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_name": null, "from_type": "Indicator", "id": "7153714c-82c5-474e-aba2-3fbb10733dbd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c19c8e47-3cd4-57df-92c1-5f62abb92a82", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.275Z", "created_at": "2026-09-26T05:17:21.509Z", "modified": "2026-09-26T05:17:21.892Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:21.892Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_name": null, "from_type": "Indicator", "id": "725be3fd-37d1-472e-ab72-71b3fb93ce2f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d6b81685-1b5c-5bb1-ba53-44336f5a60d8", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.351Z", "created_at": "2026-09-26T05:19:46.401Z", "modified": "2026-09-26T05:19:46.933Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:46.933Z" }, "description_available": false, "entity_type": "indicates", "fromId": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_name": null, "from_type": "Indicator", "id": "78be4926-8e61-4b62-b727-4f11c4f574bb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--5ec09aa3-7f5d-584f-968a-375c448a597b", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.070Z", "created_at": "2026-09-26T05:13:42.490Z", "modified": "2026-09-26T05:13:42.730Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:42.730Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_name": null, "from_type": "Indicator", "id": "79d07a8d-5733-4754-a203-378d1d1d49eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c34664be-764b-5323-b9ba-d4f007785236", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.264Z", "created_at": "2026-09-26T05:17:08.138Z", "modified": "2026-09-26T05:17:08.413Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:08.413Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_name": null, "from_type": "Indicator", "id": "7a5c8006-062e-4eda-a529-12a29bddf758", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--99307d17-5c3a-521b-a303-3264ed6a5c5c", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.959Z", "created_at": "2026-09-26T05:11:41.795Z", "modified": "2026-09-26T05:11:43.278Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:43.278Z" }, "description_available": false, "entity_type": "based-on", "fromId": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_name": null, "from_type": "Indicator", "id": "7ae38046-8e9e-485d-b837-696fa0c4ba07", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--cb67a29f-096c-5a10-9c53-c7b1dbdd0064", "toId": "516d3e92-26b1-483f-9852-977d56e00497", "to_id": "516d3e92-26b1-483f-9852-977d56e00497", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.429Z", "created_at": "2026-09-26T05:21:13.737Z", "modified": "2026-09-26T05:21:15.499Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:15.499Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca745501-93e4-4222-a598-ca408b75ff32", "from_id": "ca745501-93e4-4222-a598-ca408b75ff32", "from_name": null, "from_type": "Indicator", "id": "7b608ae8-c5d9-44b9-bc07-7f1d4423e981", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--8957a064-bd3b-5bc4-a7cb-df837a280a55", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.021Z", "created_at": "2026-09-26T05:11:53.755Z", "modified": "2026-09-26T05:11:54.118Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:54.118Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_name": null, "from_type": "Indicator", "id": "7ba1fa79-71fa-474d-9bf2-64f1154a5641", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--3147cb32-0f3a-57ae-9919-87815b79a6d5", "toId": "b19e04aa-4778-40f6-9884-f90108d08025", "to_id": "b19e04aa-4778-40f6-9884-f90108d08025", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.175Z", "created_at": "2026-09-26T05:15:23.578Z", "modified": "2026-09-26T05:15:24.048Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:24.048Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_name": null, "from_type": "Indicator", "id": "7be7a18d-ec8d-426c-b1f2-f4b638a9ed89", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--272c9b5c-fda1-5739-91e2-16aab672e01b", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.046Z", "created_at": "2026-09-26T05:12:12.855Z", "modified": "2026-09-26T05:12:13.078Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:12:13.078Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_id": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_name": null, "from_type": "Indicator", "id": "7c336087-83be-405e-b47b-d317f1bd3982", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--0c617aab-6f05-51ac-a13e-2adb85edcf0c", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.239Z", "created_at": "2026-09-26T05:16:46.314Z", "modified": "2026-09-26T05:16:46.923Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:46.923Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_name": null, "from_type": "Indicator", "id": "7c88370c-04ed-4223-bcb0-e098053311c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--22eac15b-8b03-5bec-bb67-56276210e191", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.151Z", "created_at": "2026-09-26T05:14:58.211Z", "modified": "2026-09-26T05:14:58.378Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:58.378Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "from_name": null, "from_type": "Indicator", "id": "7cc9cbb7-9a9a-4a93-8a2b-ef7164295482", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--39be342d-b952-5548-9114-4c8b72c16123", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.505Z", "created_at": "2026-09-26T05:22:48.806Z", "modified": "2026-09-26T05:22:49.210Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:49.210Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5a993697-904e-47a0-aebe-678c6017a892", "from_id": "5a993697-904e-47a0-aebe-678c6017a892", "from_name": null, "from_type": "Indicator", "id": "7fa7a454-563a-4cb8-8893-e13c264f673f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ddb1b4c2-3ab3-5e02-ae04-c580b4c65f97", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.441Z", "created_at": "2026-09-26T05:21:29.421Z", "modified": "2026-09-26T05:21:29.804Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:29.804Z" }, "description_available": false, "entity_type": "indicates", "fromId": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_id": "37732468-5575-42ed-b9c7-1305a5083bb5", "from_name": null, "from_type": "Indicator", "id": "801c7041-5ecc-482c-99c7-dfd463685036", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--7949520f-f90c-5493-abcf-4f5e6e88e8a6", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.996Z", "created_at": "2026-09-26T05:11:50.548Z", "modified": "2026-09-26T05:11:50.953Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:50.953Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_name": null, "from_type": "Indicator", "id": "81229f58-f5a4-4475-9d87-d61b3ff43313", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--118d8bd9-8933-52f5-bc98-6041b695230f", "toId": "79db2d01-74df-4eab-9b69-e93443b57609", "to_id": "79db2d01-74df-4eab-9b69-e93443b57609", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.201Z", "created_at": "2026-09-26T05:15:55.099Z", "modified": "2026-09-26T05:15:55.585Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:55.585Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_name": null, "from_type": "Indicator", "id": "83c0e7fe-d375-4e24-ba38-5a56647e9e5f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e52bfd11-72d5-5390-9c94-a6d6a979ed6f", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.941Z", "created_at": "2026-09-26T05:11:37.452Z", "modified": "2026-09-26T05:11:38.394Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:38.394Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_name": null, "from_type": "Indicator", "id": "862d0804-b5b0-41ae-be3a-894a921bef15", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--78741b74-6abf-5d9f-ac6c-9eb753c4fa5b", "toId": "446049ec-5e51-4e02-84a0-8a8f665f638d", "to_id": "446049ec-5e51-4e02-84a0-8a8f665f638d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.936Z", "created_at": "2026-09-26T05:11:33.796Z", "modified": "2026-09-26T05:11:35.622Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:35.622Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_name": null, "from_type": "Indicator", "id": "88d4c5d5-0a63-4a5a-a8d4-d190952ee250", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c198c492-95e6-59e9-99fc-af38b2aa5fa3", "toId": "f97dfd6c-e384-4e65-a42a-71e5fe6c5614", "to_id": "f97dfd6c-e384-4e65-a42a-71e5fe6c5614", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.492Z", "created_at": "2026-09-26T05:22:32.916Z", "modified": "2026-09-26T05:22:33.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:33.221Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_name": null, "from_type": "Indicator", "id": "88f4fc7f-2ca8-4fba-bd23-4df56c9daf67", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2297aa2f-0d2e-557a-82fe-7f3d578f4a09", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.287Z", "created_at": "2026-09-26T05:17:37.530Z", "modified": "2026-09-26T05:17:37.732Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:37.732Z" }, "description_available": false, "entity_type": "indicates", "fromId": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_id": "67b392c6-b5a1-4178-a868-12bfcf685900", "from_name": null, "from_type": "Indicator", "id": "8a232a00-2145-4de4-9a3a-a3562a376465", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--c4230c69-d8c5-56e1-970e-13dee3f5cafb", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.276Z", "created_at": "2026-09-26T05:17:31.562Z", "modified": "2026-09-26T05:17:31.730Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:31.730Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_name": null, "from_type": "Indicator", "id": "8a40d150-f68c-4a57-9824-2a00c4becf63", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9a8db6ae-0f79-50ed-a9c1-129539420c18", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.938Z", "created_at": "2026-09-26T05:11:37.014Z", "modified": "2026-09-26T05:11:37.731Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:37.731Z" }, "description_available": false, "entity_type": "based-on", "fromId": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_name": null, "from_type": "Indicator", "id": "8b13314a-69ff-4c58-9faa-646aa505ee15", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--924344c6-b188-5c27-b9a6-addec2c88778", "toId": "69bffd21-d89a-4d19-98d6-0a6767ac49fe", "to_id": "69bffd21-d89a-4d19-98d6-0a6767ac49fe", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.189Z", "created_at": "2026-09-26T05:15:46.856Z", "modified": "2026-09-26T05:15:47.108Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:47.108Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_name": null, "from_type": "Indicator", "id": "8fdc31a4-6f71-4361-9af5-1f3798ac16e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e32e6ee7-5084-51d5-abea-a3c7cfcc1187", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.973Z", "created_at": "2026-09-26T05:11:45.689Z", "modified": "2026-09-26T05:11:46.267Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:46.267Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_name": null, "from_type": "Indicator", "id": "94855cb2-e7b2-4704-84d0-9830d82a24a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a152f3fe-093e-5692-8ada-b46e32c16cae", "toId": "e4fd9ea3-1145-49e0-ab34-ff2ea041bee2", "to_id": "e4fd9ea3-1145-49e0-ab34-ff2ea041bee2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.428Z", "created_at": "2026-09-26T05:21:13.248Z", "modified": "2026-09-26T05:21:13.450Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:13.450Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca745501-93e4-4222-a598-ca408b75ff32", "from_id": "ca745501-93e4-4222-a598-ca408b75ff32", "from_name": null, "from_type": "Indicator", "id": "94b98e13-259a-4420-a5c2-3e47dd60fb40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1f08ad6d-5e17-523b-8965-4e26148afb38", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.966Z", "created_at": "2026-09-26T05:11:43.363Z", "modified": "2026-09-26T05:11:45.616Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:45.616Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_name": null, "from_type": "Indicator", "id": "99840b68-0520-4efd-b5ee-fac937af3ebc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--adaa2446-c109-571d-b37e-479df26bf056", "toId": "150a3879-8d13-4d1a-835c-c62386c60861", "to_id": "150a3879-8d13-4d1a-835c-c62386c60861", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.213Z", "created_at": "2026-09-26T05:16:06.951Z", "modified": "2026-09-26T05:16:08.472Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:08.472Z" }, "description_available": false, "entity_type": "indicates", "fromId": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_name": null, "from_type": "Indicator", "id": "9a6d725d-b729-4059-81ba-345aa6e70428", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ed244328-eca3-51f7-baa7-829373b63334", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.058Z", "created_at": "2026-09-26T05:13:29.389Z", "modified": "2026-09-26T05:13:31.206Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:31.206Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_id": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_name": null, "from_type": "Indicator", "id": "9af93b48-3c08-47a1-9503-839c6bebe956", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--648910b8-737a-5a03-ba11-78709e46a3cc", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.325Z", "created_at": "2026-09-26T05:19:18.989Z", "modified": "2026-09-26T05:19:23.428Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:23.428Z" }, "description_available": false, "entity_type": "indicates", "fromId": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_id": "39d64411-19f1-4a93-858b-f5069b0ea904", "from_name": null, "from_type": "Indicator", "id": "9b1d5b90-95d0-4c17-969b-f3253dd0280b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e0a5b162-c35e-5899-b1dd-dd2eaab9cec5", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.953Z", "created_at": "2026-09-26T05:11:39.296Z", "modified": "2026-09-26T05:11:40.484Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:40.484Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_name": null, "from_type": "Indicator", "id": "9b9fcdf9-503d-41ce-8547-97b2ad8b4bf0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e7858ec7-dd74-59a4-935d-621191dca015", "toId": "230575ef-d7eb-4719-8dfe-b969ec40a068", "to_id": "230575ef-d7eb-4719-8dfe-b969ec40a068", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.213Z", "created_at": "2026-09-26T05:16:09.075Z", "modified": "2026-09-26T05:16:09.340Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:09.340Z" }, "description_available": false, "entity_type": "indicates", "fromId": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_name": null, "from_type": "Indicator", "id": "9bf91e29-5a93-4ccb-9c82-a1950aa1fc02", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--5aae0ffb-91af-50bd-b5e5-dec37908a219", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.312Z", "created_at": "2026-09-26T05:18:04.229Z", "modified": "2026-09-26T05:18:04.354Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:18:04.354Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_name": null, "from_type": "Indicator", "id": "9db4ad3b-c881-4d49-9a3c-823086273e7e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--fdf982af-af8b-5646-ab34-8218027c277e", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.506Z", "created_at": "2026-09-26T05:22:49.662Z", "modified": "2026-09-26T05:22:49.980Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:49.980Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5a993697-904e-47a0-aebe-678c6017a892", "from_id": "5a993697-904e-47a0-aebe-678c6017a892", "from_name": null, "from_type": "Indicator", "id": "a2a9b133-6e06-4a15-8b49-0a6bba617431", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b83c7e6a-d059-5384-bc62-08bb861f40bf", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.469Z", "created_at": "2026-09-26T05:22:05.284Z", "modified": "2026-09-26T05:22:05.436Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:05.436Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_name": null, "from_type": "Indicator", "id": "a446cac6-06ff-4559-af19-412db2c83f69", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--f8f1f49e-d60a-5338-bf6b-fae6a59599fb", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.362Z", "created_at": "2026-09-26T05:19:58.654Z", "modified": "2026-09-26T05:19:58.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:58.801Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_name": null, "from_type": "Indicator", "id": "a4ae9c9e-326e-4cd8-9b70-c32ee5f74d63", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b49ddf31-b4c0-5d93-b7b4-655f482e5701", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.252Z", "created_at": "2026-09-26T05:16:55.529Z", "modified": "2026-09-26T05:16:55.917Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:55.917Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "from_name": null, "from_type": "Indicator", "id": "a4e9bec7-e8fd-45c8-9a47-4072ada0a974", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ec263d9c-c559-57ba-a7e6-3bad01e268e0", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.238Z", "created_at": "2026-09-26T05:16:35.115Z", "modified": "2026-09-26T05:16:35.294Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:35.294Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "from_name": null, "from_type": "Indicator", "id": "a5e1d8f2-0759-44f2-a5d5-1b36b3edc99e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--69a54b1b-048d-55cc-b464-dc81aa7af7eb", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.126Z", "created_at": "2026-09-26T05:14:27.384Z", "modified": "2026-09-26T05:14:27.764Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:27.764Z" }, "description_available": false, "entity_type": "indicates", "fromId": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "from_name": null, "from_type": "Indicator", "id": "a943d45e-9791-4091-9aef-dc58df2cc276", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--5122bcfa-7498-5059-b79d-deae7d4fa5d3", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.013Z", "created_at": "2026-09-26T05:11:52.674Z", "modified": "2026-09-26T05:11:52.923Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:52.923Z" }, "description_available": false, "entity_type": "based-on", "fromId": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_name": null, "from_type": "Indicator", "id": "ae21a745-7ed6-4172-9eed-ad08eb70eb68", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e91a88e8-2eb8-5e20-a281-b5488ee10322", "toId": "a2ae5fe6-eeab-4d4b-b30a-3726ff538020", "to_id": "a2ae5fe6-eeab-4d4b-b30a-3726ff538020", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.275Z", "created_at": "2026-09-26T05:17:22.460Z", "modified": "2026-09-26T05:17:22.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:22.613Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "from_name": null, "from_type": "Indicator", "id": "af36941d-806e-4a5d-a90e-a03bb5cea000", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a8c11989-2d36-5b3f-ad14-77be6e99a709", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.999Z", "created_at": "2026-09-26T05:11:51.388Z", "modified": "2026-09-26T05:11:51.740Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:51.740Z" }, "description_available": false, "entity_type": "based-on", "fromId": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_name": null, "from_type": "Indicator", "id": "af960233-cc45-4a36-a9c1-d2e83dc01036", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ed89367c-cdc4-5f3e-bce7-c730bab9d1f7", "toId": "b8312c24-f868-490b-89e0-553fed502b7b", "to_id": "b8312c24-f868-490b-89e0-553fed502b7b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.313Z", "created_at": "2026-09-26T05:18:04.635Z", "modified": "2026-09-26T05:18:04.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:18:04.880Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "from_name": null, "from_type": "Indicator", "id": "b06041eb-5f42-443b-8d2f-6bef1cda37c6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--08647ce9-7b23-552c-8ee8-02b165cbd46b", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.390Z", "created_at": "2026-09-26T05:20:33.691Z", "modified": "2026-09-26T05:20:33.950Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:33.950Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_name": null, "from_type": "Indicator", "id": "b0780913-31c7-42ba-af36-24bd89ec83aa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a90b9187-777d-59e6-8551-f0556d73fbb3", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.931Z", "created_at": "2026-09-26T05:11:30.982Z", "modified": "2026-09-26T05:11:31.936Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:31.936Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_name": null, "from_type": "Indicator", "id": "b1de0fec-9db8-4a21-9709-3d0af148b3da", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e0867f23-3403-52e4-bafa-0663f87f9158", "toId": "09d65463-290b-4ece-b7b8-73fa2be371b3", "to_id": "09d65463-290b-4ece-b7b8-73fa2be371b3", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.110Z", "created_at": "2026-09-26T05:14:15.901Z", "modified": "2026-09-26T05:14:16.149Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:16.149Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_name": null, "from_type": "Indicator", "id": "b439e046-9b64-435c-9433-a9f2c73ca344", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--8fd3a295-8a9c-5e64-86b6-7cc4750e97ed", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.088Z", "created_at": "2026-09-26T05:13:55.047Z", "modified": "2026-09-26T05:13:55.298Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:55.298Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_name": null, "from_type": "Indicator", "id": "b6a24523-42ae-471b-abd0-c7d2c7bc68c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--14cb35c0-bcea-56d6-b880-be87331bccb2", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.492Z", "created_at": "2026-09-26T05:22:32.276Z", "modified": "2026-09-26T05:22:32.440Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:32.440Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_name": null, "from_type": "Indicator", "id": "b70ebc51-5853-4596-9fea-8086c5137473", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--037a496c-7ee0-5b62-8ea5-f38137d7b29f", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.139Z", "created_at": "2026-09-26T05:14:51.631Z", "modified": "2026-09-26T05:14:51.833Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:51.833Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_name": null, "from_type": "Indicator", "id": "b7c9f289-b65e-4cd9-bab5-cf359772a869", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9fdfbee7-99b0-5e59-a032-9a9981d78840", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.226Z", "created_at": "2026-09-26T05:16:20.271Z", "modified": "2026-09-26T05:16:20.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:20.687Z" }, "description_available": false, "entity_type": "indicates", "fromId": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "from_name": null, "from_type": "Indicator", "id": "b7d4ca16-49b7-4638-b89a-d2439d8503d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--6f766fc5-fa80-5a78-92bf-165ede51da93", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.415Z", "created_at": "2026-09-26T05:21:01.271Z", "modified": "2026-09-26T05:21:01.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:01.464Z" }, "description_available": false, "entity_type": "indicates", "fromId": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_name": null, "from_type": "Indicator", "id": "bb07d185-553e-4f40-8633-fed4a00590fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2120ce90-1f91-5ec0-83c4-452acebb8a8e", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.350Z", "created_at": "2026-09-26T05:19:50.803Z", "modified": "2026-09-26T05:19:51.025Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:51.025Z" }, "description_available": false, "entity_type": "indicates", "fromId": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_name": null, "from_type": "Indicator", "id": "bb689dbe-9593-4079-a9c0-be893ffeecb6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d42b3147-c385-54d9-a4ad-176042aff9b2", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.189Z", "created_at": "2026-09-26T05:15:41.627Z", "modified": "2026-09-26T05:15:42.068Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:42.068Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "from_name": null, "from_type": "Indicator", "id": "bf171112-ee24-408b-b76c-dcc9f3401859", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--7030bf64-2fd9-5f25-9192-b5bd8ba1123c", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.263Z", "created_at": "2026-09-26T05:17:07.240Z", "modified": "2026-09-26T05:17:07.642Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:17:07.642Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "from_name": null, "from_type": "Indicator", "id": "c217df2e-7971-4e57-82c1-592a0533be25", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1bb69a3b-b1ba-5378-a0f8-37496ca5354a", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.058Z", "created_at": "2026-09-26T05:13:27.026Z", "modified": "2026-09-26T05:13:27.776Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:27.776Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_id": "ef46b969-b83c-42f6-9399-70267f990d7d", "from_name": null, "from_type": "Indicator", "id": "c280fcc7-0c6c-4067-b40a-b4dc783c6c22", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--f69006d8-3b34-5001-baea-b89b941fc55f", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.389Z", "created_at": "2026-09-26T05:20:32.832Z", "modified": "2026-09-26T05:20:33.421Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:33.421Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "from_name": null, "from_type": "Indicator", "id": "c5025557-261c-4789-ba99-5ac84a18e66d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--61144a90-cf25-520a-aa1a-276381a8b869", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.046Z", "created_at": "2026-09-26T05:12:13.561Z", "modified": "2026-09-26T05:12:13.873Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:12:13.873Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_id": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_name": null, "from_type": "Indicator", "id": "c7455f2b-4eba-490a-9052-719bd932328c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a00b5717-dda8-536a-a5aa-19e9047bffa0", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.032Z", "created_at": "2026-09-26T05:11:58.515Z", "modified": "2026-09-26T05:11:59.301Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:59.301Z" }, "description_available": false, "entity_type": "based-on", "fromId": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_id": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_name": null, "from_type": "Indicator", "id": "c87b2257-fe0f-4dde-ab3a-eaeefe8ac0c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--fd5dca21-827f-501e-b26c-4dcd385bcb33", "toId": "a08bb6c7-8406-40f1-9e45-506b22353672", "to_id": "a08bb6c7-8406-40f1-9e45-506b22353672", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.518Z", "created_at": "2026-09-26T05:23:01.697Z", "modified": "2026-09-26T05:23:02.247Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:23:02.247Z" }, "description_available": false, "entity_type": "indicates", "fromId": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_id": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_name": null, "from_type": "Indicator", "id": "c9311edd-2d66-4f59-8c78-fafff3a2974e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1cb55dc0-7f91-5bc3-8bcc-ac3a32ade7ef", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.363Z", "created_at": "2026-09-26T05:19:59.012Z", "modified": "2026-09-26T05:19:59.181Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:59.181Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "from_name": null, "from_type": "Indicator", "id": "cbadee24-ecf4-45fd-b23a-58a999c26fd5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--6f025e80-0f38-56a4-aa89-4b06c73bab37", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.087Z", "created_at": "2026-09-26T05:13:54.383Z", "modified": "2026-09-26T05:13:54.548Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:54.548Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_name": null, "from_type": "Indicator", "id": "cbd03e36-2132-4504-9176-c84891cafeac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--28a91dc3-5761-5fed-a8db-d1e682415aad", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.337Z", "created_at": "2026-09-26T05:19:26.585Z", "modified": "2026-09-26T05:19:26.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:26.906Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_name": null, "from_type": "Indicator", "id": "cc940c3f-a741-40c1-b796-8ca4284e9cbf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e1132cb7-47e5-562c-a83d-c9ed1040b0cb", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.071Z", "created_at": "2026-09-26T05:13:43.186Z", "modified": "2026-09-26T05:13:43.504Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:43.504Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "from_name": null, "from_type": "Indicator", "id": "d1332422-6e4b-42d8-a9a0-00c8e221fed3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--31c31281-3a67-5cdd-b2a2-a21d511240e7", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.518Z", "created_at": "2026-09-26T05:23:00.987Z", "modified": "2026-09-26T05:23:01.187Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:23:01.187Z" }, "description_available": false, "entity_type": "indicates", "fromId": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_id": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_name": null, "from_type": "Indicator", "id": "d16fea9c-4744-45de-a780-8e33bbe85838", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--4649c515-177e-528b-bd85-80b775a163fd", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.089Z", "created_at": "2026-09-26T05:13:55.883Z", "modified": "2026-09-26T05:13:56.450Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:13:56.450Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "from_name": null, "from_type": "Indicator", "id": "d186bbc1-2f83-46a7-97a1-d4ca1ccd61c6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--8aa8072a-cc84-5206-8688-74a6ed37ec9d", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.023Z", "created_at": "2026-09-26T05:11:55.464Z", "modified": "2026-09-26T05:11:57.449Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:57.449Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "from_name": null, "from_type": "Indicator", "id": "d4ed89ef-326e-4209-94e8-48d9c4736088", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--904d5df8-9cfe-52b8-8119-84310af9367c", "toId": "09f6d8a2-c77c-4d2a-ac79-80e2083c84ac", "to_id": "09f6d8a2-c77c-4d2a-ac79-80e2083c84ac", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:33:43.417Z", "created_at": "2026-08-10T19:34:56.306Z", "modified": "2026-08-10T19:34:56.505Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-10T19:34:56.505Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_name": null, "from_type": "Indicator", "id": "d65af8c2-a49a-4d9d-9ac1-05df813ab83d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--7f98d5a1-e097-5a27-b6be-e791596462df", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.109Z", "created_at": "2026-09-26T05:14:11.545Z", "modified": "2026-09-26T05:14:12.043Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:12.043Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_name": null, "from_type": "Indicator", "id": "da657a8a-6090-4e74-83ca-d1af27aa29c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--9506049f-40b1-5c36-93bc-ccf8c7eaf706", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.111Z", "created_at": "2026-09-26T05:14:12.297Z", "modified": "2026-09-26T05:14:12.484Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:12.484Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "from_name": null, "from_type": "Indicator", "id": "da685657-07e9-4c28-8b37-b3739b436dad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--a4b53c9e-659f-5cce-909d-20c686fdcc42", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.338Z", "created_at": "2026-09-26T05:19:36.061Z", "modified": "2026-09-26T05:19:36.325Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:36.325Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_name": null, "from_type": "Indicator", "id": "da86bc3b-9713-4ab3-9a49-239724b4933b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b709289c-4803-55bf-9f47-e8782c0dca1e", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.028Z", "created_at": "2026-09-26T05:11:57.432Z", "modified": "2026-09-26T05:11:58.210Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:58.210Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_name": null, "from_type": "Indicator", "id": "dbea8eef-8f72-45c7-849d-813cc6533c32", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--6f1243ff-c2fc-53d1-93ef-a89e9dd44985", "toId": "8746d110-6b23-41e6-aec2-9b189661f26d", "to_id": "8746d110-6b23-41e6-aec2-9b189661f26d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.519Z", "created_at": "2026-09-26T05:23:05.546Z", "modified": "2026-09-26T05:23:05.965Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:23:05.965Z" }, "description_available": false, "entity_type": "indicates", "fromId": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_id": "173ea392-25c8-45d3-8dea-f8a306686a9a", "from_name": null, "from_type": "Indicator", "id": "e093b681-fa81-4692-94fb-32176a7592d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1e67b291-3aee-59cd-9933-4bdd1e23bf86", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.950Z", "created_at": "2026-09-26T05:11:39.297Z", "modified": "2026-09-26T05:11:40.485Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:40.485Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "from_name": null, "from_type": "Indicator", "id": "e3733a57-e4ae-41dd-99d8-adac8d8e98cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--58e7c3dd-faea-52aa-a67a-f739033228a4", "toId": "ed6887d7-db22-44b5-b43d-6db3fe55f377", "to_id": "ed6887d7-db22-44b5-b43d-6db3fe55f377", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.416Z", "created_at": "2026-09-26T05:21:01.781Z", "modified": "2026-09-26T05:21:01.904Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:01.904Z" }, "description_available": false, "entity_type": "indicates", "fromId": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "from_name": null, "from_type": "Indicator", "id": "e456cd85-7a9c-4d0d-959a-6cb0bd31a778", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--796c65d3-1c77-54f0-90b0-7d5d12a0ca60", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.338Z", "created_at": "2026-09-26T05:19:27.945Z", "modified": "2026-09-26T05:19:28.135Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:28.135Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "from_name": null, "from_type": "Indicator", "id": "e4980cac-c4f6-4c96-b32e-4cb27027b68d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d8875df0-56ac-5bb6-ace5-8cf110f79933", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.163Z", "created_at": "2026-09-26T05:15:10.415Z", "modified": "2026-09-26T05:15:10.554Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:15:10.554Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "from_name": null, "from_type": "Indicator", "id": "e6e7ca58-380f-4668-83e3-fa469323a615", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--236a88af-f5e8-589e-951c-f7bb6037ab53", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.033Z", "created_at": "2026-09-26T05:11:58.792Z", "modified": "2026-09-26T05:11:59.325Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:59.325Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "from_name": null, "from_type": "Indicator", "id": "e891390c-576b-43e2-a120-62bc531f292c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b941721f-cd54-5aa9-a9ba-03d9b3418037", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.404Z", "created_at": "2026-09-26T05:20:51.712Z", "modified": "2026-09-26T05:20:51.971Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:51.971Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_name": null, "from_type": "Indicator", "id": "e924d775-f9b0-4830-b43c-e9f9cb8aec72", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b6c0519e-aca4-5bbc-8534-cceacf5a40bf", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.214Z", "created_at": "2026-09-26T05:16:13.836Z", "modified": "2026-09-26T05:16:13.999Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:16:13.999Z" }, "description_available": false, "entity_type": "indicates", "fromId": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "from_name": null, "from_type": "Indicator", "id": "e9f5ae5e-9fd0-4cc4-9ec8-67ae1c491fe8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--d5b18aa9-b8b7-5184-b790-eef83c8998f7", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.047Z", "created_at": "2026-09-26T05:12:15.079Z", "modified": "2026-09-26T05:12:15.210Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:12:15.210Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_id": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_name": null, "from_type": "Indicator", "id": "eab9749f-335b-4efb-8ba8-1c854db71ffc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--668e72dc-4cbc-528d-b715-2a16cafa9227", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.138Z", "created_at": "2026-09-26T05:14:44.829Z", "modified": "2026-09-26T05:14:45.066Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:14:45.066Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "from_name": null, "from_type": "Indicator", "id": "ef1069c5-f4f5-4df7-bdf3-a43fac27641f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--2efa4d8d-2ff2-554e-b485-77e9ef5b3db7", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.956Z", "created_at": "2026-09-26T05:11:41.272Z", "modified": "2026-09-26T05:11:41.858Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:41.858Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "from_name": null, "from_type": "Indicator", "id": "ef321b34-1eae-4774-87d3-c21d2edff3c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--dd913fcf-994c-5416-ae90-b240d043b76a", "toId": "27cefc1a-15b0-4975-a320-63f60256ff90", "to_id": "27cefc1a-15b0-4975-a320-63f60256ff90", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.350Z", "created_at": "2026-09-26T05:19:44.954Z", "modified": "2026-09-26T05:19:45.416Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:19:45.416Z" }, "description_available": false, "entity_type": "indicates", "fromId": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "from_name": null, "from_type": "Indicator", "id": "f1b09eab-05e9-4fc6-a29d-10c8027ce3fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1f134d1e-7047-57fd-81b0-f0c9286381a1", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:10.925Z", "created_at": "2026-09-26T05:11:27.369Z", "modified": "2026-09-26T05:11:29.989Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:29.989Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_id": "bf21b399-fc6f-4b85-923b-e1f1345cdbb6", "from_name": null, "from_type": "Indicator", "id": "f2633529-e152-48ad-9cde-931cd4f31a80", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--ec1f3c6d-7f92-5b57-a1c3-aab2104a303d", "toId": "42d3d254-0d95-4f03-9e67-a0064b8e2142", "to_id": "42d3d254-0d95-4f03-9e67-a0064b8e2142", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.403Z", "created_at": "2026-09-26T05:20:50.380Z", "modified": "2026-09-26T05:20:50.635Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:50.635Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_name": null, "from_type": "Indicator", "id": "f60bb78b-35f0-453c-b672-dd828aa86def", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--e3942832-a074-5eb0-859d-ee799d14b303", "toId": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "to_name": "CASTLELOADER", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.403Z", "created_at": "2026-09-26T05:20:47.909Z", "modified": "2026-09-26T05:20:49.349Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:49.349Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "from_name": null, "from_type": "Indicator", "id": "f744b0e0-e0bf-48e5-87d8-9d8dcbd5d2e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--1d8bdb2b-d6c3-5f3e-b571-42906c4f071c", "toId": "f98918ea-513a-4435-960c-de289dc50d7b", "to_id": "f98918ea-513a-4435-960c-de289dc50d7b", "to_name": "SloppyRAT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.454Z", "created_at": "2026-09-26T05:21:57.232Z", "modified": "2026-09-26T05:21:57.465Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:21:57.465Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "from_name": null, "from_type": "Indicator", "id": "f836cca7-7292-4bc3-b4e0-34860dba5f49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--35ad492c-a1e3-5469-80ad-c9de63c148f8", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.377Z", "created_at": "2026-09-26T05:20:29.441Z", "modified": "2026-09-26T05:20:29.598Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:20:29.598Z" }, "description_available": false, "entity_type": "indicates", "fromId": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "from_name": null, "from_type": "Indicator", "id": "fa38890e-5d46-48e0-ba1d-58c41e984576", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--6ae967dd-3e91-5a0e-a909-8baf711e09aa", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.030Z", "created_at": "2026-09-26T05:11:58.289Z", "modified": "2026-09-26T05:11:58.726Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:11:58.726Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5a993697-904e-47a0-aebe-678c6017a892", "from_id": "5a993697-904e-47a0-aebe-678c6017a892", "from_name": null, "from_type": "Indicator", "id": "fdf62c57-5224-44f8-90ba-f36d44a73f81", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b4215002-e2d8-5564-b84a-ee48793dbdef", "toId": "75cef387-d1cc-4d5b-b81b-f2dc0fc310b3", "to_id": "75cef387-d1cc-4d5b-b81b-f2dc0fc310b3", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:11.493Z", "created_at": "2026-09-26T05:22:39.536Z", "modified": "2026-09-26T05:22:39.649Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:22:39.649Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "from_name": null, "from_type": "Indicator", "id": "fe101660-fc54-4b9b-a6fe-9385c17ad36f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--342f8c01-2ecf-5c2a-a59b-548baa5b143f", "toId": "d9bacd37-b311-4282-86f5-690679adc49e", "to_id": "d9bacd37-b311-4282-86f5-690679adc49e", "to_name": "NightshadeC2", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9342371634011778[.]com", "description_available": false, "object_id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "object_ids": [ "a5cced2a-e515-4c59-b9c0-1b39b10efc73", "e5dbdebc-faba-4ae4-82a1-3d41af821808" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e5dbdebc-faba-4ae4-82a1-3d41af821808", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2026-12-22T08:30:36.260Z", "validity_status": "active", "value": "9342371634011778.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "a5cced2a-e515-4c59-b9c0-1b39b10efc73", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9342371634011778.com" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "domain", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2026-12-22T08:30:36.260Z", "validity_status": "active", "value": "9342371634011778.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "linked4x[.]com", "description_available": false, "object_id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "object_ids": [ "6a67ffd9-ac26-4e96-9967-556918cf93ae", "8746d110-6b23-41e6-aec2-9b189661f26d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6a67ffd9-ac26-4e96-9967-556918cf93ae", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2026-12-22T08:30:36.260Z", "validity_status": "active", "value": "linked4x.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "8746d110-6b23-41e6-aec2-9b189661f26d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "linked4x.com" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "domain", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2026-12-22T08:30:36.260Z", "validity_status": "active", "value": "linked4x.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "skipraid[.]com", "description_available": false, "object_id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "object_ids": [ "b761e594-ccb5-49d5-b05a-311d4d7afff1", "eb194e16-42d9-414f-a726-b1565b8243aa" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b761e594-ccb5-49d5-b05a-311d4d7afff1", "valid_from": "2026-07-28T03:35:19.000Z", "valid_until": "2026-11-07T18:30:27.260Z", "validity_status": "active", "value": "skipraid.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "eb194e16-42d9-414f-a726-b1565b8243aa", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "skipraid.com" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "domain", "valid_from": "2026-07-28T03:35:19.000Z", "valid_until": "2026-11-07T18:30:27.260Z", "validity_status": "active", "value": "skipraid.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1c15653d8428e69ff2cadf3a3a1f506f", "description_available": false, "object_id": "ef46b969-b83c-42f6-9399-70267f990d7d", "object_ids": [ "b4a870c9-9bc1-4844-be61-54eb9fe1f586", "ef46b969-b83c-42f6-9399-70267f990d7d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ef46b969-b83c-42f6-9399-70267f990d7d", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "1c15653d8428e69ff2cadf3a3a1f506f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b4a870c9-9bc1-4844-be61-54eb9fe1f586", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1c15653d8428e69ff2cadf3a3a1f506f" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "md5", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "1c15653d8428e69ff2cadf3a3a1f506f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5731f763100773be35669757b8accc95", "description_available": false, "object_id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "object_ids": [ "09d65463-290b-4ece-b7b8-73fa2be371b3", "e0fc2702-ed99-48ee-bba4-7a0baa310389" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e0fc2702-ed99-48ee-bba4-7a0baa310389", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "5731f763100773be35669757b8accc95" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "09d65463-290b-4ece-b7b8-73fa2be371b3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5731f763100773be35669757b8accc95" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "md5", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "5731f763100773be35669757b8accc95" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5966d07d4cb3a9241fe4df0ad70ad665", "description_available": false, "object_id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "object_ids": [ "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "71065c2e-0937-4a31-a098-8e6bb6e2f793" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4bb6fd92-8551-48cc-9077-9d5fe3b1bd76", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "5966d07d4cb3a9241fe4df0ad70ad665" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "71065c2e-0937-4a31-a098-8e6bb6e2f793", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5966d07d4cb3a9241fe4df0ad70ad665" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "md5", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "5966d07d4cb3a9241fe4df0ad70ad665" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f52464f721825936cd1338eac49ece10", "description_available": false, "object_id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "object_ids": [ "e91e8f0a-38fa-43ea-b243-adadb0e29340", "f97dfd6c-e384-4e65-a42a-71e5fe6c5614" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e91e8f0a-38fa-43ea-b243-adadb0e29340", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "f52464f721825936cd1338eac49ece10" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f97dfd6c-e384-4e65-a42a-71e5fe6c5614", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f52464f721825936cd1338eac49ece10" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "md5", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "f52464f721825936cd1338eac49ece10" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3f90411b3a3ed8cbe079db215a9bf68b9017a9fc", "description_available": false, "object_id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "object_ids": [ "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "69bffd21-d89a-4d19-98d6-0a6767ac49fe" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "017c96d1-bb96-4ea5-a4bd-442a19488bf0", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "3f90411b3a3ed8cbe079db215a9bf68b9017a9fc" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "69bffd21-d89a-4d19-98d6-0a6767ac49fe", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3f90411b3a3ed8cbe079db215a9bf68b9017a9fc" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha1", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "3f90411b3a3ed8cbe079db215a9bf68b9017a9fc" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "70e1412bd5ff942cb85233764968349e0181683e", "description_available": false, "object_id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "object_ids": [ "3d7f337f-1fee-45df-9b4d-f026571acf7c", "446049ec-5e51-4e02-84a0-8a8f665f638d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3d7f337f-1fee-45df-9b4d-f026571acf7c", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "70e1412bd5ff942cb85233764968349e0181683e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "446049ec-5e51-4e02-84a0-8a8f665f638d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "70e1412bd5ff942cb85233764968349e0181683e" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha1", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "70e1412bd5ff942cb85233764968349e0181683e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7b52af88cbd890b1d547729adf40b8d94c7cace6", "description_available": false, "object_id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "object_ids": [ "6ebf6b4d-f515-4cb7-b60c-a1871c914225", "c138bb81-4e09-4d43-a943-1ac1707d05bc" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c138bb81-4e09-4d43-a943-1ac1707d05bc", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "7b52af88cbd890b1d547729adf40b8d94c7cace6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "6ebf6b4d-f515-4cb7-b60c-a1871c914225", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7b52af88cbd890b1d547729adf40b8d94c7cace6" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha1", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "7b52af88cbd890b1d547729adf40b8d94c7cace6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d5435129570d9656dc7d9f6578a291d173025e4d", "description_available": false, "object_id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "object_ids": [ "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "f888710c-f66e-4890-85cb-f4c46c76f1ce" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cd193a0a-b9b9-42ee-942a-bc8f5a805fbc", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "d5435129570d9656dc7d9f6578a291d173025e4d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f888710c-f66e-4890-85cb-f4c46c76f1ce", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d5435129570d9656dc7d9f6578a291d173025e4d" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha1", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "d5435129570d9656dc7d9f6578a291d173025e4d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec", "description_available": false, "object_id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "object_ids": [ "d677b1b5-fd64-4a13-a2db-219a4064159e", "ed6887d7-db22-44b5-b43d-6db3fe55f377" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d677b1b5-fd64-4a13-a2db-219a4064159e", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ed6887d7-db22-44b5-b43d-6db3fe55f377", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd", "description_available": false, "object_id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "object_ids": [ "230575ef-d7eb-4719-8dfe-b969ec40a068", "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ae543d52-c5d1-494a-b8ff-e3cf2e2eab5c", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "230575ef-d7eb-4719-8dfe-b969ec40a068", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2", "description_available": false, "object_id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "object_ids": [ "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "27cefc1a-15b0-4975-a320-63f60256ff90" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0818e4cc-e110-4dcd-a010-9603cbae5c9a", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "27cefc1a-15b0-4975-a320-63f60256ff90", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19", "description_available": false, "object_id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "object_ids": [ "35c138f0-799a-468c-9dab-9ebbcb05d476", "516d3e92-26b1-483f-9852-977d56e00497" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "35c138f0-799a-468c-9dab-9ebbcb05d476", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "516d3e92-26b1-483f-9852-977d56e00497", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8", "description_available": false, "object_id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "object_ids": [ "012048cb-cb41-4202-8038-3a077ce64694", "96221ab5-9941-4eb5-984d-46b2056b28c4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "96221ab5-9941-4eb5-984d-46b2056b28c4", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "012048cb-cb41-4202-8038-3a077ce64694", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56", "description_available": false, "object_id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "object_ids": [ "150a3879-8d13-4d1a-835c-c62386c60861", "fb452ca6-b9ca-4107-a6b6-4ececca98e81" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fb452ca6-b9ca-4107-a6b6-4ececca98e81", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "150a3879-8d13-4d1a-835c-c62386c60861", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064", "description_available": false, "object_id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "object_ids": [ "4afcdf19-5bd9-4d3e-b031-75bd248f024e", "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e74dab1d-e54c-47c1-b9c8-ea609b4a8ea7", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "4afcdf19-5bd9-4d3e-b031-75bd248f024e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9", "description_available": false, "object_id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "object_ids": [ "a6ba7f6e-392e-42a2-b650-0965794f22ae", "e4fd9ea3-1145-49e0-ab34-ff2ea041bee2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a6ba7f6e-392e-42a2-b650-0965794f22ae", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e4fd9ea3-1145-49e0-ab34-ff2ea041bee2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21", "description_available": false, "object_id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "object_ids": [ "77052f76-29d1-4ac9-a1a4-52f5b66959ce", "ef483c58-3171-40d5-80d3-91f23c28ab93" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ef483c58-3171-40d5-80d3-91f23c28ab93", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "77052f76-29d1-4ac9-a1a4-52f5b66959ce", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013", "description_available": false, "object_id": "67b392c6-b5a1-4178-a868-12bfcf685900", "object_ids": [ "67b392c6-b5a1-4178-a868-12bfcf685900", "fb6717f7-eabc-4ba6-98ab-93c34f0dc16a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "67b392c6-b5a1-4178-a868-12bfcf685900", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "fb6717f7-eabc-4ba6-98ab-93c34f0dc16a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7", "description_available": false, "object_id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "object_ids": [ "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "b9bcc399-952b-456c-a528-64b89702f110" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "937ec076-cdb7-478f-a805-0cc83b6bf3ae", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b9bcc399-952b-456c-a528-64b89702f110", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990", "description_available": false, "object_id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "object_ids": [ "4af466a5-997d-4c29-99cb-556abd9cc955", "ce79f8dc-31ee-46c3-b866-1bc06356abbd" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ce79f8dc-31ee-46c3-b866-1bc06356abbd", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "4af466a5-997d-4c29-99cb-556abd9cc955", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490", "description_available": false, "object_id": "39d64411-19f1-4a93-858b-f5069b0ea904", "object_ids": [ "39d64411-19f1-4a93-858b-f5069b0ea904", "a1d8b01b-a784-4961-adcb-fb07daec2314" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "39d64411-19f1-4a93-858b-f5069b0ea904", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a1d8b01b-a784-4961-adcb-fb07daec2314", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d", "description_available": false, "object_id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "object_ids": [ "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "79db2d01-74df-4eab-9b69-e93443b57609" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1fffea20-1bbd-49e0-9f7e-6367f0e8f751", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "79db2d01-74df-4eab-9b69-e93443b57609", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a", "description_available": false, "object_id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "object_ids": [ "b8312c24-f868-490b-89e0-553fed502b7b", "db6c89a6-0cd9-45ed-8c61-a6c902e21298" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "db6c89a6-0cd9-45ed-8c61-a6c902e21298", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b8312c24-f868-490b-89e0-553fed502b7b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316", "description_available": false, "object_id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "object_ids": [ "79fe414b-672e-4404-bbb0-c4b3fe554a66", "fac83473-b628-4ed1-b62e-43707b122172" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "79fe414b-672e-4404-bbb0-c4b3fe554a66", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "fac83473-b628-4ed1-b62e-43707b122172", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588", "description_available": false, "object_id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "object_ids": [ "591cba70-608e-4bd9-a01a-b15b15338e2d", "bd16419d-d64f-413d-8759-4ddd8bbce584" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "591cba70-608e-4bd9-a01a-b15b15338e2d", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "bd16419d-d64f-413d-8759-4ddd8bbce584", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd", "description_available": false, "object_id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "object_ids": [ "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "6843d8e1-a49b-4fa6-ada2-d1f7353c7cac" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3823dcd5-b36b-4537-a13a-703b70bf3ef7", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "6843d8e1-a49b-4fa6-ada2-d1f7353c7cac", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189", "description_available": false, "object_id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "object_ids": [ "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "51cf4354-8c54-49fa-b41d-6c4f5afe9606" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3633bb8d-ed41-4de5-82bb-f8492d523eb4", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "51cf4354-8c54-49fa-b41d-6c4f5afe9606", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189", "description_available": false, "object_id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "object_ids": [ "63c6ab3e-6bc7-4587-864a-475c1f15d010", "a2ae5fe6-eeab-4d4b-b30a-3726ff538020" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "63c6ab3e-6bc7-4587-864a-475c1f15d010", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a2ae5fe6-eeab-4d4b-b30a-3726ff538020", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d", "description_available": false, "object_id": "ca745501-93e4-4222-a598-ca408b75ff32", "object_ids": [ "a6443bde-0ee5-47b9-8a23-e81726562c85", "ca745501-93e4-4222-a598-ca408b75ff32" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ca745501-93e4-4222-a598-ca408b75ff32", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a6443bde-0ee5-47b9-8a23-e81726562c85", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb", "description_available": false, "object_id": "37732468-5575-42ed-b9c7-1305a5083bb5", "object_ids": [ "37732468-5575-42ed-b9c7-1305a5083bb5", "da6c7da2-cb8d-4e60-9db0-b9a375f38d1e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "37732468-5575-42ed-b9c7-1305a5083bb5", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "da6c7da2-cb8d-4e60-9db0-b9a375f38d1e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5", "description_available": false, "object_id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "object_ids": [ "b19e04aa-4778-40f6-9884-f90108d08025", "b2b87f76-a7f6-4dd8-9b84-92250729c6d3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b2b87f76-a7f6-4dd8-9b84-92250729c6d3", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b19e04aa-4778-40f6-9884-f90108d08025", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "sha256", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2027-06-28T04:45:12.557Z", "validity_status": "active", "value": "ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//skipraid[.]com/dsVGmQTrzX/default2", "description_available": false, "object_id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "object_ids": [ "09f6d8a2-c77c-4d2a-ac79-80e2083c84ac", "8ab34a7e-2c08-4d37-ad23-47a76fd536ad" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8ab34a7e-2c08-4d37-ad23-47a76fd536ad", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2026-09-30T23:10:07.434Z", "validity_status": "revoked", "value": "http://skipraid.com/dsVGmQTrzX/default2" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "09f6d8a2-c77c-4d2a-ac79-80e2083c84ac", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://skipraid.com/dsVGmQTrzX/default2" } ], "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "type": "url", "valid_from": "2026-09-10T17:35:28.000Z", "valid_until": "2026-09-30T23:10:07.434Z", "validity_status": "revoked", "value": "http://skipraid.com/dsVGmQTrzX/default2" } ], "mentioned": [ { "confidence": 50, "evidence_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "name": "CASTLELOADER", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "d9bacd37-b311-4282-86f5-690679adc49e", "name": "NightshadeC2", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "f98918ea-513a-4435-960c-de289dc50d7b", "name": "SloppyRAT", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:33:01.288Z", "created_at": "2026-04-13T22:25:46.032Z", "modified": "2026-04-13T22:25:46.734Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-13T22:25:46.734Z" }, "description_available": false, "entity_type": "uses", "fromId": "7262b430-7e06-4139-b4bc-081aae009a3c", "from_id": "7262b430-7e06-4139-b4bc-081aae009a3c", "from_name": "CASTLELOADER", "from_type": "Malware", "id": "c947044e-012c-4866-bf26-a649feab2659", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--4e530683-e274-5f18-b273-8bf62079466c", "toId": "c7538cd1-9f22-4ce3-b4b2-8e94dabe7a95", "to_id": "c7538cd1-9f22-4ce3-b4b2-8e94dabe7a95", "to_name": "T1181", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1181" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T23:33:01.285Z", "created_by": null, "dates": { "created": "2026-01-19T23:33:01.285Z", "created_at": "2026-04-13T22:25:21.116Z", "modified": "2026-04-13T22:25:21.771Z", "updated_at": "2026-04-13T22:25:21.771Z" }, "description_available": false, "evidence_ids": [ "c7538cd1-9f22-4ce3-b4b2-8e94dabe7a95", "c947044e-012c-4866-bf26-a649feab2659" ], "external_id": "T1181", "id": "c7538cd1-9f22-4ce3-b4b2-8e94dabe7a95", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1181", "modified": "2026-04-13T22:25:21.771Z", "name": "T1181", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1181", "id": "8e961f26-ae7f-4171-bd0e-fd0e46ae9af2", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1181" } ], "relationship_ids": [ "c947044e-012c-4866-bf26-a649feab2659" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "tactics": [], "url": "https://attack.mitre.org/techniques/T1181/", "via_entities": [ { "id": "7262b430-7e06-4139-b4bc-081aae009a3c", "name": "CASTLELOADER", "type": "Malware" } ] } ], "via_entity": { "id": "7262b430-7e06-4139-b4bc-081aae009a3c", "name": "CASTLELOADER", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:23:47.928Z", "created_at": "2026-04-10T12:47:47.227Z", "modified": "2026-04-10T12:47:47.574Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-10T12:47:47.574Z" }, "description_available": false, "entity_type": "uses", "fromId": "d9bacd37-b311-4282-86f5-690679adc49e", "from_id": "d9bacd37-b311-4282-86f5-690679adc49e", "from_name": "NightshadeC2", "from_type": "Malware", "id": "8eb29c5a-c0a5-4419-b85d-91804612f1d0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "standard_id": "relationship--b5a510ff-c4e4-5050-8a6c-fe04a52bbfef", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "8eb29c5a-c0a5-4419-b85d-91804612f1d0", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "8eb29c5a-c0a5-4419-b85d-91804612f1d0" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "d9bacd37-b311-4282-86f5-690679adc49e", "name": "NightshadeC2", "type": "Malware" } ] } ], "via_entity": { "id": "d9bacd37-b311-4282-86f5-690679adc49e", "name": "NightshadeC2", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T05:07:36Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1181/", "created": "2018-01-16T16:13:52.465Z", "deprecated": false, "matched": true, "mitre_id": "T1181", "modified": "2026-04-14T22:53:15.422Z", "official_name": "Extra Window Memory Injection", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0004", "name": "Privilege Escalation", "shortname": "privilege-escalation" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1055/011/", "mitre_id": "T1055.011", "official_name": "Extra Window Memory Injection", "official_status": "active", "relationship_id": "relationship--8be10d07-69bd-47ae-9dea-5918d1005699", "stix_id": "attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298" } ], "revoked": true, "stix_id": "attack-pattern--52f3d5a6-8a0f-4f82-977e-750abf90d0b0" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-10T17:35:27.546Z", "created_at": "2026-09-26T05:23:18.041Z", "modified": "2026-09-26T05:23:20.306Z", "published": "2026-09-10T17:35:27.546Z", "updated_at": "2026-09-26T05:23:20.306Z" }, "description_available": true, "id": "fe6059a5-11fc-404f-8038-4fc3da02b6a6", "is_inferred": false, "labels": [ "castleloader", "castlerat", "certificate pinning", "clickfix", "etherhiding", "indirect syscalls", "polygon", "powershell", "ransomware", "sloppyrat" ], "lang": "en", "name": "SloppyRAT: A New Tool For Ransomware Attacks", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-10T17:35:27.546Z", "references": [ { "external_id": null, "id": "d43ce1d0-3b99-4d61-9437-4556c991af1e", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks" }, { "external_id": "6aa2ea5fc313035064df8d21", "id": "a9439130-d7db-4366-8369-9781b93122ba", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa2ea5fc313035064df8d21" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "fe6059a5-11fc-404f-8038-4fc3da02b6a6", "schema_version": 1, "selected_date": "2026-09-10", "source_url": "https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks" }