When IT Support Calls: Dissecting a ModeloRAT Campaign from Teams to Domain Compromise

Rapid7 investigated an April 2026 enterprise intrusion that began with a Microsoft Teams message from a spoofed “IT Support” account. The attacker abused Teams external access to deliver a Dropbox-hosted Python payload that installed ModeloRAT, established C2, deployed multiple backdoors, and performed reconnaissance. The actor escalated privileges to SYSTEM using CVE-2023-36036, deployed a fake Windows lock screen to harvest a domain password, then used stolen credentials and living‑off‑the‑land techniques for lateral movement and data exfiltration — resulting in full domain compromise and an