I found out more about the mentioned issues.
1) The command gsmctl -U seems to generally not work on the RUT240 (at least until firmware 1.12.3)
2) You can get the response from a USSD if you send the AT+CUSD command like this:
By default, the Quectel EC25 chip sends the asynchronous response (=URC; unsolicited result code) back via command-channel. This means you send the USSD command and gsmctl disconnects from the channel before the answer is received. But it is possible to receive the answer via data-channel and fetch it by using microcom. To achieve this, you have to configure EC25 to send the URC to the data-channel:
gsmctl -A 'AT+QURCCFG="urcport","usbmodem"'
The configuration is saved to NV immediately and stays there even after factory reset. You can then get the response by executing the following:
root@Teltonika-RUT240:~# gsmctl -A 'AT+CUSD=1,*130#,15'
root@Teltonika-RUT240:~# microcom -t 5000 /dev/modem_data
+CUSD: 0,"Ihr Restguthaben ist CHF 13.85",15
Take care, as the microcom command just catches everything that is sent to the data-channel while the 5000ms. Your provider could also send sms and other network data at the same time.
I have a few RUT240's working now with this modified config of the Quectel EC25. No problems found so far. But I'm not 100% comfortable with changing default config in NV. I'm not responsible if you brick your device or something even worse happens. It would be really cool if Teltonika implements a official and working way to get the USSD response.