Do Son ReliaQuest warns Initial Access Broker "KongTuke" is abusing external Microsoft Teams chats to deploy the highly resilient ModeloRAT. Audit tenants now!
KongTuke
Trend Micro exposes KongTuke's new "CrashFix" tactic, which tricks enterprise users via fake Chrome errors into deploying the fileless modeloRAT backdoor.
Trustwave uncovers a fake CAPTCHA campaign delivering NodeJS backdoors via PowerShell and TryCloudflare, with SOCKS5 tunneling and RAT capabilities.