ModeloRAT Propose Change

According to Rapid7, ModeloRAT is a Python-based remote access trojan framework previously tied to the KongTuke group's browser extension campaigns, which in this incident was delivered through Microsoft Teams social engineering using a portable WinPython environment to bypass traditional detections. Its capabilities center on a long-running HTTP C2 beacon that can load DLLs via rundll32, launch additional Python modules, execute PowerShell commands, install MSI packages, handle persistence, and self-update or remove, while supporting supplementary modules for reverse shells, SOCKS proxying, and HTTP tunneling. The Python modules are obfuscated and run through pythonw.exe to avoid visible console windows, with all communication blended into normal-looking web traffic over port 80.

References

There is no Yara-Signature yet.