KongTuke Uses External Teams Chats to Deploy ModeloRAT

May 14, 2026 · Original article ↗

Summary

ReliaQuest reports KongTuke is impersonating help-desk staff in external Teams chats to trick users into running PowerShell that installs ModeloRAT, whose multiple C2 paths and layered persistence complicate containment.

Key points

ReliaQuest attributes the activity to financially motivated initial access broker KongTuke, citing reuse of the group's custom Python loader; this is the first use of a collaboration platform observed in this campaign.
The actor impersonates internal IT or help-desk staff in external Teams chats and directs users to run a PowerShell command that downloads a ZIP from Dropbox and launches ModeloRAT through portable WinPython.
In investigated incidents, the operator rotated across five Microsoft 365 tenants in 45 days, and hosts began beaconing within five minutes of the user running the command.
ModeloRAT has three independent access paths; its primary implant uses a five-server C2 pool with failover, randomized URL paths, and self-update capability.
Persistence includes a registry Run key, a Startup shortcut, and a VBScript launcher; some hosts also received a SYSTEM-level scheduled task that the implant's self-destruct routine does not remove.
The toolkit can capture screenshots and exfiltrate files on operator command, according to ReliaQuest.
ReliaQuest recommends restricting external Teams federation to trusted organizations, hunting for portable WinPython in AppData, and checking all persistence locations before returning affected hosts to production.

Article Details

Attack Vectors: KongTuke impersonated internal IT or help-desk staff in external Microsoft Teams chats to persuade users to run a PowerShell command.
The command downloaded a ZIP payload from Dropbox, extracted a portable WinPython runtime and ModeloRAT scripts into AppData, and launched them with pythonw.exe.
ModeloRAT used a primary implant, a secondary reverse shell, and a raw TCP backdoor on separate infrastructure; the primary implant beaconed over HTTP and could exfiltrate files and screenshots.
Persistence included a registry Run key, a Startup shortcut, and a VBScript launcher; some hosts also received a SYSTEM-level scheduled task.
The reconnaissance collector used hidden PowerShell to gather system, user, domain, and group information, including LDAP enumeration.
Defensive Notes: Restrict external Teams federation to a trusted-organization allowlist.
Hunt managed endpoints for portable WinPython directories under %APPDATA%RoamingWPy64-* and related VBScript launchers.
Before returning a host to production, enumerate and remove Run keys, Startup shortcuts, VBScript launchers, and scheduled tasks running as SYSTEM with names mimicking legitimate folders.
Treat disruption of a single C2 channel or persistence artifact as incomplete containment; investigate all three access paths and every persistence mechanism.
Correlate external Teams chats from unfamiliar tenants with hidden PowerShell, portable Python appearing in AppData, and Startup-folder changes.
Assess confirmed compromises for potential data loss because ModeloRAT can capture screenshots and exfiltrate files on operator command.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]172[.]99[.]68`	Reported KongTuke C2 or proxy infrastructure; listed as a ModeloRAT C2 server.
IPV4	`162[.]33[.]179[.]149`	Listed among the campaign’s C2 and proxy infrastructure.
IPV4	`45[.]61[.]136[.]94`	Reported KongTuke C2 or proxy infrastructure.
IPV4	`64[.]95[.]10[.]14`	Listed among the campaign’s C2 and proxy infrastructure.
IPV4	`64[.]95[.]12[.]238`	Listed among the campaign’s C2 and proxy infrastructure.
IPV4	`64[.]95[.]13[.]76`	Listed among the campaign’s C2 and proxy infrastructure.
URL	`hxxps[:]//www[.]dropbox[.]com/scl/fi/88btyiyisjwbuxhappb8m/ltuipoaensloieo[.]zip`	Specific Dropbox-hosted ZIP URL identified as delivering the ModeloRAT payload.
URL	`hxxps[:]//www[.]dropbox[.]com/scl/fi/vpyhgodqd358qtp0fmnzr/at3[.]zip`	Specific Dropbox-hosted ZIP URL identified as a ModeloRAT delivery variant.