Executive Summary
Since April 2026, the financially motivated initial access broker (IAB) KongTuke has evolved its tradecraft by shifting from web-based 'ClickFix' lures to social engineering via external Microsoft Teams chats. Impersonating internal IT support, the actor tricks users into executing a PowerShell command that deploys 'ModeloRAT,' a modular toolkit bundled with a portable WinPython runtime. This campaign leverages the high trust associated with collaboration platforms to establish a persistent foothold in under five minutes.
Technically, the operation is notable for its emphasis on survivability. ModeloRAT utilizes three independent C2 paths and up to four layered persistence mechanisms, including registry keys, startup shortcuts, VBScript launchers, and SYSTEM-level scheduled tasks. This redundancy ensures that the actor maintains access even if defenders disrupt primary communication channels or perform standard cleanup.
The shift to collaboration platforms as an initial access vector represents a significant risk to organizations that have not yet implemented strict governance over external federation. KongTuke's activity often serves as a precursor to ransomware deployments, making rapid detection of its portable Python environments and hidden PowerShell execution critical for preventing high-impact downstream attacks.