KongTuke — Threat Actor Profile, Campaigns & Targets

Related Threat Clusters

Mistic Malware Targets Microsoft Endpoint with Stealthy DLL Sideloading Technique
The Mistic malware, a newly identified Windows backdoor, has been active since April 2026, utilizing DLL sideloading to infiltrate enterprise environments. It exploits a legitimate executable, MpExtMs.exe, to load a…

2 articles · Updated June 30, 2026
Rhysida and Interlock Ransomware Groups Exploit Shared Malware Ecosystem
Recent analysis reveals that Rhysida and Interlock ransomware groups are interconnected through a shared ecosystem of malware tools, including the Supper backdoor. Both groups utilize initial access brokers and a…

3 articles · Updated June 16, 2026
Cyberattackers Exploit ClickFix Script via DNS TXT Records for PowerShell Execution
Cyberattackers have been exploiting DNS TXT records within the ClickFix script to execute malicious PowerShell commands. This tactic has been linked to the KongTuke campaign, which has been active since mid-2025 and…

15 articles · Updated February 5, 2026
CrashFix Campaign Delivers ModeloRAT via Malicious Chrome Extension
A malicious campaign named CrashFix has been identified, utilizing a fake ad-blocking browser extension called NexShield to crash users' browsers. This tactic is employed to facilitate ClickFix attacks, delivering a new…

3 articles · Updated January 20, 2026

Mistic Malware Blends Into Microsoft Endpoint Components Using Malicious EndpointDlp.dll — Gbhackers · June 30, 2026
Rhysida and Interlock Ransomware Groups Linked to Initial Access Brokers and Crypter Ecosystem — Gbhackers · June 16, 2026
DNS TXT Records Exploited In ClickFix Script For Remote PowerShell Command Execution — Cyberpress · February 5, 2026
Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands — Cybersecuritynews · February 5, 2026
CrashFix attack hijacks browser failures to deliver ModelRAT malware via fake Chrome extension — Csoonline · January 20, 2026

Woodgnat Malware Phishing Ransomware Supply Chain Attack Contagious Interview Operation CrashFix FileFix LandUpdate808 Tag-124 Education OptinMonster