{"id":8546,"date":"2025-11-19T04:03:38","date_gmt":"2025-11-19T04:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/11\/19\/32498\/"},"modified":"2025-11-19T04:03:38","modified_gmt":"2025-11-19T04:03:38","slug":"32498","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/11\/19\/32498\/","title":{"rendered":"KongTuke activity, (Tue, Nov 18th)"},"content":{"rendered":"

KongTuke activity, (Tue, Nov 18th)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Introduction<\/strong><\/em><\/p>\n

Today’s diary is an example of KongTuke activity using fake CAPTCHA pages for a ClickFix<\/a>-style lure.<\/p>\n

Also known as LandUpdate808 or TAG-124 and described as a sophisticated TDS system<\/a>, KongTuke has been active since at least May 2024.\u00a0 I keep track of this campaign through the infosec.exchange<\/a> Mastodon instance, which is mostly information from the @monitorsg<\/a> profile.<\/p>\n

With URLscan<\/a>, I can pivot on the information from Mastodon to find compromised sites and generate infection traffic in my lab.<\/p>\n

On Monday, 2025-11-17, I found an example of a legitimate website with a KongTuke-injected script, and I generated some infection traffic.<\/p>\n

Details<\/strong><\/em><\/p>\n

The image below shows an example of the fake CAPTCHA page and ClickFix style instructions.<\/p>\n

\"\"<\/a>
\nShown above: Fake CAPTCHA page from a legitimate site with KongTuke-injected script, with the ClickFix style instructions and malicious command.<\/em><\/p>\n

The CAPTCHA page hijacks the clipboard, injecting text for a malicious command to download and run PowerShell script. Potential victims would read the instructions and paste this command into Run window.<\/p>\n

I tried this on a vulnerable Windows client in an Active Directory (AD) environment, and it ran PowerShell script that retrieved a zip archive containing a malicious Python script, as well as the Windows Python environment to run it.<\/p>\n

The malicious Python script generated HTTPS traffic to telegra[.]ph<\/span>, but I was unable to determine the URL or content of the traffic.<\/p>\n

\"\"<\/a>
\nShown above: Traffic from the infection, filtered in Wireshark.<\/em><\/p>\n

\"\"<\/a>
\nShown above: Initial PowerShell script retrieved by the ClickFix command that was pasted into the Run window.<\/em><\/p>\n

\"\"<\/a>
\nShown above: Final HTTP request from the initial infection traffic returned a zip archive containing a Python environment and a malicious Python script.<\/em><\/p>\n

Post-Infection Forensics<\/strong><\/em><\/p>\n

The malicious Python package was saved to the Windows client under the user account’s AppDataRoaming<\/span> directory under a folder named DATA<\/span>. A scheduled task kept the infection persistent.<\/p>\n

\"\"<\/a>
\nShown above: The malicious Python script, made persistent on the infected Windows client through a scheduled task.<\/em><\/p>\n

Indicators from the infection<\/em><\/strong><\/p>\n

The following URLs were generated during the initial infection traffic:<\/p>\n