KongTuke
KongTuke is an active traffic distribution system (TDS) and financially motivated initial access broker (IAB) service, also tracked as TAG-124, LandUpdate808, Chaya_002, and 404 TDS. It has been active since at least May 2024 and compromises legitimate websites, especially WordPress sites, by injecting attacker-controlled JavaScript that fingerprints visitors and redirects selected victims into staged infection chains. Its most commonly described delivery method is fake CAPTCHA, ClickFix, and CrashFix social engineering that tricks users into pasting or executing malicious PowerShell commands, though reporting also describes a shift in 2026 to external Microsoft Teams chats where operators impersonate IT or help-desk staff to obtain persistent access in corporate environments. KongTuke operates as an access broker rather than a single malware family. Reported delivery chains include obfuscated JavaScript-to-PowerShell stages, clipboard hijacking, abuse of LOLBins such as finger.exe, AMSI bypass, ETW suppression, anti-analysis checks, victim profiling, and selective payloading based on environment characteristics such as domain membership and security tooling. Multiple reports describe profiling logic that distinguishes standalone WORKGROUP systems from domain-joined enterprise systems and delivers more capable payloads to organizational victims. Payloads and downstream activity directly associated with KongTuke in the provided content include ModeloRAT, XorBee RAT, XWorm RAT, MintsLoader, GhostWeaver RAT, Remcos RAT, AsyncRAT, Interlock RAT, Emmenhtal, D3F@CK Loader, and other Python-based backdoors. The content states that KongTuke serves multiple downstream customers, including ransomware operators and affiliates associated with Rhysida, Interlock, 8Base, Akira, and AlphV/BlackCat, and that APT groups TA866/Asylum Ambuscade and TA582 have also used KongTuke. The infrastructure and delivery model are described as consistent with a shared malware-as-a-service or TDS-for-hire operation with rapid domain rotation, numerous C2 nodes, and hundreds of compromised WordPress sites.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
13 malware families attributed to this actor across reporting.
8 additional families tracked in Mallory.
Observables
149 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A financially motivated initial access broker shifting from compromised WordPress-hosted ClickFix/CrashFix lures to external Microsoft Teams chat-based social engineering, impersonating help-desk or IT staff to trick users into executing PowerShell and rapidly establish persistent enterprise access.
Initial access broker conducting Microsoft Teams-based social engineering to trick employees into executing malicious PowerShell, leading to persistent access and likely resale of access to ransomware operators.
Conducting social-engineering-driven intrusions that impersonate IT support via Microsoft Teams and deliver ModeloRAT into corporate environments.
Primary sustained operator of MintsLoader campaigns, using phishing emails and ClickFix/Kongtuke lures to deliver the loader and ultimately GhostWeaver, StealC, or modified BOINC clients. Campaigns target industrial, legal, and energy sectors in the US and Europe.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.