ModeloRAT
ModeloRAT is a Python-based remote access trojan/backdoor associated with the financially motivated initial access broker Woodgnat, also known as KongTuke. Reporting links its use to access-broker activity supporting ransomware ecosystems including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, and Symantec separately observed ModeloRAT in attacks that deployed Qilin ransomware. The malware has been delivered into corporate environments through social-engineering campaigns, including ClickFix/CrashFix-style lures on compromised WordPress infrastructure and, from at least April 2026, Microsoft Teams messages impersonating IT or help-desk staff that trick victims into running malicious PowerShell commands. Huntress first reported on ModeloRAT in January 2026 during investigation of the CrashFix campaign.
Observed delivery chains include malicious PowerShell that downloads a portable WinPython environment and launches ModeloRAT via a signed or bundled pythonw.exe interpreter. In Teams-based intrusions, reported artifacts included scriptA.vbs, StartManagerB.lnk, Pmanager.py, and the portable Python runtime WPy64-31401, with persistence established through Startup shortcuts, VBScript launchers, Run keys, and scheduled tasks. Reporting also states that newer variants use multiple independent command-and-control paths, automatic failover across a server pool, randomized URL paths, self-update capability, and multiple access channels including a primary RAT, reverse shell, and TCP backdoor.
High-confidence capabilities directly described in the source material include collection of system and user information, screenshot capture, file exfiltration, and resilient persistence inside enterprise networks. Related reporting states that ModeloRAT commonly targets domain-joined or corporate systems and has been used in attacks against organizations in sectors including education, insurance, IT, and professional services. Additional infrastructure and behavior linked in the content include RC4-encrypted command-and-control communications, multiple independent C2 paths, and delivery through KongTuke traffic-distribution infrastructure built on compromised WordPress sites and fake CAPTCHA/ClickFix lures.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Local privilege escalation exploit CVE-2023-36036 (JunkFiction-crypted) ... CVE CVE-2023-36036 Local privilege escalation exploit used by Interlock and ModeloRAT operators | A newer Python-based backdoor called ModeloRAT, deployed by the TAG-124 traffic distribution network tied to Interlock, further extends NodeSnake’s code structure and uses identical network validation bytes.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They linked the campaign to a group active since May 2024 known as Woodgnat hackers (aka KongTuke). Woodgnat hackers, who also deploy a tool called ModeloRAT, act as a middleman for ransomware networks like Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
They linked the campaign to a group active since May 2024 known as Woodgnat hackers (aka KongTuke). Woodgnat hackers, who also deploy a tool called ModeloRAT, act as a middleman for ransomware networks like Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
Techniques & procedures
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
They hijack normal WordPress websites to push fake technical alerts. In a recent tactic from early 2026 called CrashFix, they purposely froze a victim’s web browser and displayed a message telling them to copy-paste a command to fix the issue.
Execution
6 techniques
Execution
Persistence is established through several redundant mechanisms, including... scheduled tasks.
"...trick them into running arbitrary commands under the pretext of running a security scan."
The campaign used a malicious Chrome extension named NexShield, disguised as an ad blocker, to intentionally crash victims’ browsers and trick them into running PowerShell commands that led to the deployment of ModeloRAT.
Persistence is established through several redundant mechanisms, including... VBScript launchers
Persistence
4 techniques
Persistence
Persistence is established through several redundant mechanisms, including... scheduled tasks.
The campaign used a malicious Chrome extension named NexShield, disguised as an ad blocker, to intentionally crash victims’ browsers and trick them into running PowerShell commands that led to the deployment of ModeloRAT.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
loaded from a DLL named EndpointDlp.dll, a name associated with Microsoft endpoint-security tooling. This would help the backdoor blend in with trusted software... Persistence is established through several redundant mechanisms, including Run-key entries that masquerade as legitimate remote-access software, using names such as AnyDesk, Splashtop and Comms.
"...the attack chain uses DNS as a 'lightweight staging or signaling channel.'"
Credential Access
1 technique
Credential Access
Discovery
5 techniques
Discovery
performing Active Directory and Kerberoasting queries against accounts with service principal names to harvest crackable credentials
The group then conducts extensive reconnaissance using built-in Windows tooling, enumerating domain users, groups, computers and sessions with net.exe
Collection
2 techniques
Collection
Command and Control
8 techniques
Command and Control
It can also create new folders, and check for additional commands from the attacker-controlled command-and-control (C2) server.
The RAT uses RC4-encrypted command-and-control (C2) communications and is built for resilience, with multiple independent C2 paths on separate infrastructure.
"The malware was also distributed in a different ClickFix campaign that involved running commands carrying out a Domain Name System (DNS) lookup to retrieve the next-stage payload, with Microsoft noting that the attack chain uses DNS as a 'lightweight staging or signaling channel.'"
The backdoor can run remote payloads directly in memory... Upload/download a file... Once a command is executed, a multi-stage PowerShell chain downloads and unpacks a portable WinPython environment... Finger.exe... retrieve obfuscated payloads.
"...the attack chain uses DNS as a 'lightweight staging or signaling channel.'"
Mistic is a stealthy backdoor used by KongTuke-linked actors to keep long-term access in ransomware-targeted networks.
IOCs tracked for this family
35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access tool deployed by the Woodgnat/KongTuke group as part of operations that broker access to ransomware affiliates.
A KongTuke-linked remote access trojan/backdoor associated with intrusions where Mistic was later deployed. The content notes it has spread through Microsoft Teams social engineering and is suspected to be part of Woodgnat's custom stealthy remote access tooling.
A Python remote access trojan attributed to KongTuke/Woodgnat, distributed via ClickFix-style campaigns and fake IT support lures to establish remote access and deliver follow-on payloads.
A Python-based remote access trojan developed by Woodgnat and deployed via a ClickFix campaign called CrashFix, where a malicious Chrome extension named NexShield crashed browsers and tricked victims into running PowerShell commands that installed the malware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.