# KongTuke Hackers Evolve Tactics: Microsoft Teams Becomes Weapon for Lightning-Fast Corporate Network Breaches
The notorious initial access broker known as KongTuke has added a dangerous new arrow to its arsenal—Microsoft Teams—enabling attackers to compromise corporate networks in as little as five minutes. The shift marks a significant evolution in how cybercriminals approach initial access, leveraging trusted collaboration platforms to bypass traditional defenses and social engineering employees into executing malicious code.
## The Threat
Security researchers at ReliaQuest have documented a new campaign by KongTuke in which attackers impersonate IT and help-desk staff on Microsoft Teams, convincing targeted employees to execute a PowerShell command that delivers the ModeloRAT malware—a Python-based remote access trojan previously associated with ClickFix campaigns.
What makes this approach particularly concerning is its speed and effectiveness. In the incidents ReliaQuest investigated:
The threat actor uses sophisticated display name manipulation—Unicode whitespace tricks—to make malicious accounts appear as legitimate internal IT support. Once an employee is socially engineered into running the PowerShell command, the attacker gains a persistent foothold on the victim's network, which can then be sold to ransomware operators and other cybercriminals seeking network access for destructive operations.
## Background and Context
Initial Access Brokers: A Critical Layer in Ransomware Supply Chains
Initial access brokers like KongTuke form the first step in a multi-stage attack ecosystem. These specialized threat actors focus solely on gaining a toehold inside corporate networks—they break in, establish persistence, and then sell access credentials to other cybercriminals. Ransomware gangs, data theft operations, and APT groups purchase this access to launch their own campaigns.
For years, KongTuke relied primarily on web-based social engineering tactics, leveraging fake support tools like FileFix and CrashFix to trick users into downloading malware. These web-based lures typically required redirecting users to fraudulent websites, creating an additional friction point in the attack chain.
The shift to Microsoft Teams represents a strategic pivot. Since Teams is already installed on millions of corporate desktops and deeply integrated into business workflows, it requires no additional clicks or redirects—it's already trusted infrastructure. An attacker who can impersonate an internal contact on Teams has already won half the battle.
## Technical Details: How the Attack Works
Stage 1: Social Engineering via Teams
The attacker initiates contact through an external Microsoft Teams chat, using a spoofed display name designed to mimic IT support staff. By leveraging Unicode whitespace characters, attackers can create usernames that appear legitimate to casual inspection—for example, inserting zero-width spaces or right-to-left override characters that don't render visibly but change how the name is parsed.
The initial message requests the victim run a PowerShell command "to fix a connectivity issue" or similar pretext. Because the request comes through Teams and appears to come from IT, employees comply without escalating or verifying.
Stage 2: Malware Delivery via Dropbox
The PowerShell command, when executed, downloads a ZIP archive from Dropbox containing a portable WinPython environment. Using Dropbox for payload hosting is a practical choice for attackers: the service has high reputation, legitimate business use, and is less likely to be blocked by corporate firewalls compared to direct command-and-control infrastructure.
Once extracted, the archive initializes a Python runtime environment that executes ModeloRAT (also referenced in code as Pmanager.py), a fully-featured remote access trojan.
Stage 3: Reconnaissance and Persistence
According to ReliaQuest's analysis, the ModeloRAT variant used in this campaign has evolved significantly:
| Capability | Details |
|-----------|---------|
| System Reconnaissance | Collects OS, hardware, and user information for victim profiling |
| Surveillance | Captures screenshots for ongoing visibility into victim activity |
| Data Exfiltration | Can enumerate and steal files from the infected host |
| Command & Control | Five-server failover architecture with randomized URL paths |
| Self-Update | Can download and execute updated variants without user interaction |
Advanced Persistence Mechanisms
The malware implements multiple, redundant persistence methods designed to survive standard cleanup and system reboots:
Critically, ReliaQuest researchers found that the scheduled task is not removed by the malware's own self-destruct routine—meaning if an organization attempts to clean the infection by triggering the malware's cleanup function, that particular persistence mechanism survives, allowing the attacker to regain access after the system reboots.
## Implications for Organizations
The Convergence of Legitimate Platforms and Attack Infrastructure
This campaign illustrates a broader threat trend: attackers no longer need to build or compromise dedicated infrastructure for initial compromise. By weaponizing Microsoft Teams—a platform already trusted by hundreds of millions of employees—KongTuke reduces detection friction and increases success rates. Employees are trained to respond to Teams messages from colleagues; attackers simply exploit that muscle memory.
The Five-Minute Window
The ability to move from first contact to persistent network access in under five minutes means traditional incident detection baselines may fail. Many security operations centers (SOCs) are tuned to detect lateral movement, privilege escalation, or data exfiltration—stages that happen *after* the initial compromise. By the time alerts fire, the attacker has already established redundant persistence mechanisms and may have exfiltrated credentials.
Ransomware as a Service Implication
Initial access brokers sell network access to ransomware gangs at the wholesale level. A single compromised corporate network can fetch anywhere from tens of thousands to hundreds of thousands of dollars, depending on company size and data value. KongTuke's success with this new Teams-based method will likely accelerate adoption across the threat actor ecosystem.
## Recommendations
For System Administrators and Security Teams
1. Restrict External Teams Federation: Configure Microsoft Teams to use an allowlist for external federation, explicitly blocking all external tenants except those your organization explicitly whitelists. This blocks cold-outreach attacks at the platform level.
2. Enable Teams Security Policies:
- Require external identities to be approved before initial message
- Disable anonymous meeting join links
- Enforce multi-factor authentication (MFA) for all Teams users
3. Hunt for Indicators of Compromise: ReliaQuest has published specific IoCs from this campaign. Organizations should use these to search for:
- PowerShell execution logs matching the command patterns
- Suspicious Python process launches
- Scheduled tasks created by non-administrative users
- Dropbox downloads to %TEMP% directories
4. User Education: Train employees to verify unexpected requests through out-of-band channels. A request to "run this PowerShell command" from IT should always be verified through a phone call to a known IT number or in-person visit.
5. Endpoint Detection and Response (EDR): Deploy or enhance EDR solutions configured to alert on:
- PowerShell execution with obfuscation or unusual encoding
- Python processes launched from temporary directories
- Suspicious scheduled task creation
- Registry modifications for persistence
---
## HackWire Analysis
This campaign represents a maturation of the initial access broker ecosystem. For years, security awareness training warned employees about "phishing emails" and "suspicious links"—abstract threats that could be dismissed as unlikely. But Teams-based attacks exploit a psychological vulnerability that traditional security training doesn't address: the implicit trust in internal communication platforms.
An employee who would instantly delete a cold email from "itsupport@company.com" will respond to a Teams message from what appears to be a known internal contact. The platform itself provides the legitimacy the attacker needs. This is why the attack succeeds so reliably and so quickly.
The five-server failover architecture and multiple persistence mechanisms in ModeloRAT also signal something important: this malware is designed to survive not just initial cleanup attempts, but sophisticated threat hunting. The fact that the scheduled task persistence survives the malware's own self-destruct routine suggests KongTuke expects organizations will eventually detect and attempt to remove the infection—and they've engineered workarounds.
The use of Dropbox for payload hosting is particularly pragmatic. Rather than burning direct C2 infrastructure that could be taken down or sinkholed, attackers use legitimate cloud services as a staging point. This pattern—using trusted platforms both for delivery (Teams) and payload hosting (Dropbox)—will likely become standard across the IAB ecosystem because it works and because defenders struggle to block it without impacting legitimate business use.
For defenders, this should accelerate a shift in mindset: the threat is no longer external. The threat is now someone posing as internal on a platform your employees already trust. Detection and response must assume that any Teams message requesting technical execution is a potential attack until proven otherwise. — HackWire Editorial
---
## Related Coverage