nslookup.exe

nslookup.exe is a built-in Windows DNS lookup utility. In February 2026, KongTuke began using nslookup against attacker-controlled DNS servers to retrieve payloads via DNS response fields. The technique replaces commonly blocked PowerShell/mshta approaches and blends into normal network traffic. The nslookup output is filtered to extract the DNS response Name field, which is then executed as a second-stage payload. Final payloads include ModeloRAT.