SloppyMIO
- First seen
- 2023-03-15 00:00:00
- Malware type
- backdoor, rat, trojan
- Family
- Malware family
- Last IoC activity
- 2026-07-07 03:55:08
- Profile updated
- 2026-07-07 13:17:35
Targeted industries: technology-and-telecommunications government-and-public-sector financial-services
Context
According to HarfangLab, SloppyMIO is written in C#. It retrieves its configuration steganographically from images whose URLs are obtained via a Dead Drop Resolver (DDR) backed by GitHub. From these images, it extracts a XOR key, Telegram bot token and chat ID, and module URLs from an LSB-hidden payload. The malware can fetch and cache multiple modules from remote storage, run arbitrary commands, collect and exfiltrate files and deploy further malware with persistence via scheduled tasks. SloppyMIO beacons status messages, polls for commands and sends exfiltrated files over to a specified operator leveraging the Telegram Bot API for command-and-control.
Detection coverage
- 1 YARA rules
Detection rules
- HARFANGLAB_Trr260101_Sloppymio (yara-rule)
Reports & references
- harfanglab.io — Redkitten Ai Accelerated Campaign Targeting Iranian Protests (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sloppy Mio (report)