SloppyMIO
SloppyMIO is a modular backdoor/implant used in the Iran-linked RedKitten campaign targeting NGOs, activists, journalists, academics, government officials, business leaders, and other individuals involved in documenting human rights abuses and protests in Iran, with reported emphasis on Kurdish community targets. It has been described as both a C# implant and, in some reporting, a C-based implant loaded via AppDomainManager injection. Delivery was observed through spearphishing lures such as Farsi-named 7-Zip archives containing malicious or macro-enabled Excel spreadsheets themed around protester deaths; weaponized spreadsheet documents and VBA macros were used to trigger the infection chain. The malware is also reported in one source as being delivered by weaponized spreadsheet documents with steganographic configuration extraction from images hosted on legitimate code repositories.
SloppyMIO uses GitHub as a dead-drop resolver to obtain a Google Drive URL, then retrieves images containing steganographically embedded configuration data. Reported configuration elements include a Telegram bot token, Telegram chat ID, and links for staging additional modules. Command-and-control and exfiltration are conducted through the Telegram Bot API. HarfangLab noted the actor relied on commoditized infrastructure including GitHub, Google Drive, and Telegram, which complicates infrastructure-based tracking while creating potential OPSEC exposure.
The implant is modular and supports arbitrary command execution, file collection and exfiltration, retrieval and caching of additional modules, further malware delivery, and launching arbitrary processes. Reported modules include: "cm" for shell command execution via cmd.exe; "do" for collecting, ZIP-archiving, and exfiltrating files subject to Telegram API size limits; "up" for writing files to disk using data encoded in images delivered via Telegram; "ra" for launching processes; and "pr" for persistence. Persistence has been reported via scheduled tasks executed every two hours. Additional reported behaviors include beaconing to a configured Telegram chat ID, polling for commands, and returning results.
Known file/path details directly mentioned in reporting include the dropped DLL name AppVStreamingUX_Multi_User.dll and placement under %LOCALAPPDATA%\Microsoft\CLR_v4.0_32\NativeImages. The malware has been associated with AppDomainManager injection, scheduled task persistence, steganographic configuration retrieval, and use of GitHub/Google Drive/Telegram as part of its multi-hop C2 and payload staging chain.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Weaponized spreadsheet documents deployed the SloppyMIO implant, a C# backdoor that used steganography to extract configuration data from images hosted on legitimate code repositories...
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
"it's suspected that the threat actors are relying on spear-phishing or 'protracted social engineering efforts' in which the operators build rapport with the victims over time before sending the malicious payloads... approaching prospective targets under fake personas and cultivating a relationship"
Execution
1 technique
Execution
Stealth
2 techniques
Stealth
Command and Control
3 techniques
Command and Control
Finally, for command and control and exfiltration, Iranian-linked groups most commonly rely on application layer protocols (T1071), such as HTTP
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
C# backdoor using steganography and dead-drop resolver architecture via cloud and messaging APIs to blend malicious traffic with legitimate services.
Custom backdoor used in a separate, Iran-focused targeting campaign (RedKitten) against NGOs and individuals documenting human rights abuses.
C-based implant/backdoor delivered via malicious Excel VBA macro; uses AppDomainManager injection and leverages GitHub as a dead drop resolver to retrieve/cache modules, execute arbitrary commands, exfiltrate files, and distribute additional malware.
C# implant/backdoor delivered via password-protected Excel lures; uses Telegram for command-and-control and GitHub/Google Drive for payload hosting, with steganographic configuration, AppDomain Manager injection, and scheduled task persistence.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.