ModeloRAT Campaign via Microsoft Teams Phishing

In April 2026, an enterprise intrusion was identified involving the KongTuke group (associated with ModeloRAT) and tradecraft mirroring Octo Tempest. The attack began with social engineering via Microsoft Teams, where attackers impersonated IT support to deliver a malicious Python-based payload via Dropbox. This campaign highlights a shift from browser-based delivery to the abuse of trusted collaboration platforms to bypass initial perimeter defenses.

The attack chain progressed rapidly from initial execution to full domain compromise. The threat actors utilized a portable WinPython environment to execute various backdoors, including ModeloRAT and multiple custom reverse shells. Notably, the actors exploited CVE-2023-36036, a Windows Cloud Files Mini Filter Driver vulnerability, to gain SYSTEM privileges. They then deployed a sophisticated fake lock screen to capture plaintext domain passwords, enabling lateral movement via RDP and Kerberoasting.

This intrusion underscores the critical risk posed by external access features in collaboration tools like Teams. By chaining 'Living-off-the-Land' techniques with kernel-level exploits and identity abuse, the attackers were able to move from initial access to data exfiltration within 48 hours. Organizations must prioritize monitoring external collaboration traffic and ensuring rapid patching of kernel-mode drivers.