Preliminary entry dealer KongTuke has moved to Microsoft Groups for social engineering assaults, taking as little as 5 minutes to realize persistent entry to company networks.
The risk actor methods customers into pasting a PowerShell command that finally delivers the ModeloRAT, which has been beforehand seen in ClickFix assaults [1, 2].
Preliminary entry brokers (IAB) like KongTuke sometimes promote firm community entry to ransomware operators, who use it to deploy file-theft and data-encrypting malware.
Cybercriminals have more and more adopted Microsoft Groups in assaults, reaching out to firm staff and pretending to be IT and help-desk workers.
The victims are satisfied to run a malicious PowerShell command on their programs, which deploys the “ModeloRAT” malware.
Supply: ReliaQuest
ReliaQuest researchers noticed this exercise and say that it’s a shift in ways for KongTuke, who beforehand relied solely on web-based “FileFix” and “CrashFix” lures.
“This Groups exercise, which seems so as to add to, quite than substitute, that web-based strategy, marks the primary time we’ve seen KongTuke use a collaboration platform for preliminary entry,” explains ReliaQuest.
“Within the incidents we investigated, a single exterior Groups chat moved the operator from chilly outreach to a persistent foothold in below 5 minutes.”
The marketing campaign has been lively since no less than April 2026, with KongTuke rotating by 5 Microsoft 365 tenants to evade blocking, the researchers say.
To cross as inside IT help workers, the attacker makes use of Unicode whitespace methods to make the show identify seem respectable.
The malicious PowerShell command shared through Groups downloads a ZIP archive from Dropbox that accommodates a conveyable WinPython atmosphere, which finally launches the Python-based malware, ModeloRAT (Pmanager.py).
The malware collects system and consumer info, captures screenshots, and may exfiltrate information from the host filesystem.
ReliaQuest notes that the ModeloRAT model used on this latest marketing campaign has advanced in comparison with what was seen in earlier operations, principally in 3 ways:
- A extra resilient C2 structure with a five-server pool, automated failover, randomized URL paths, and self-update functionality.
- A number of impartial entry paths, together with a major RAT, a reverse shell, and a TCP backdoor, operating on separate infrastructure to protect entry if one channel is disrupted.
- Expanded persistence mechanisms utilizing Run keys, Startup shortcuts, VBScript launchers, and SYSTEM-level scheduled duties that will survive normal cleanup procedures.
The researchers observe that the scheduled process isn’t eliminated by the implant’s self-destruct routine, which wipes the opposite persistence mechanisms, and may persist by system reboots.
Supply: ReliaQuest
To defend in opposition to Crew-initiated assaults, it’s endorsed to limit exterior Microsoft Groups federation utilizing allowlists to dam these makes an attempt at their begin.
Moreover, directors can use the symptoms of compromise out there in ReliaQuest’s report back to hunt for assaults, indicators of compromise, and persistence artifacts.
AI chained 4 zero-days into one exploit that bypassed each renderer and OS sandboxes. A wave of latest exploits is coming.
On the Autonomous Validation Summit (Could 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls maintain, and closes the remediation loop.
