Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT — Threadlinqs Intelligence
As of 2026-06-24, Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT is a high-severity malware threat attributed to Woodgnat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 44 indicators of compromise.
Threat ID: TL-2026-0933 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Woodgnat · FINANCIAL
Backdoor.Mistic (tracked as MLTBackdoor by Zscaler ThreatLabz) is a heavily obfuscated, in-memory backdoor with Beacon Object File (BOF) execution and a kill-switch self-delete, deployed since April
Backdoor.Mistic — tracked independently as MLTBackdoor by Zscaler ThreatLabz — is a custom in-memory backdoor first observed in April 2026 and reported by Symantec/Security.com on 24 June 2026. It is deployed by Woodgnat (Symantec naming), the same actor cluster Zscaler and others track as KongTuke / TAG-124 / LandUpdate808 / Chaya_002 / 404 TDS, a financially motivated initial access broker (IAB) and traffic distribution system (TDS) active since May 2024.
Infection chain: victims reach a ClickFix-style lure (an automotive-themed webpage in the Zscaler chain, and helpdesk/IT-support pretexts delivered through external Microsoft Teams chats from April 2026 onward). The lure preloads a command to the clipboard and instructs the user to paste-and-run it. PowerShell/cmd then creates a temp directory and uses curl to download a compressed archive containing data.bin (an RC4-encrypted payload, key in the payload header) and a loader DLL (endpointdlp.dll). After a self-update, Mistic is sideloaded via the legitimate Windows binary mpextms.exe: a loader (version.dll) hooks GetModuleFileNameW (to redirect path queries to the legitimate mpextms.exe location) and LoadLibraryW (to load the malicious EndpointDlp.dll containing Mistic). The DLL name impersonates Microsoft endpoint-security tooling to blend with trusted software.
Capabilities: file upload/download, file move/rename/delete, folder creation, command check-frequency modification, in-memory payload execution without disk writes, and self-termination/self-deletion via a kill switch. A full COFF/BOF loader allocates memory per section, walks the symbol table and applies relocations, sets sections RX-only, resolves 7 standard Beacon imports plus 19 additional syscall wrappers (NtCreateFile, NtReadFile, NtWriteFile, registry ops), and executes Beacon Object Files to extend functionality at runtime.
Evasion: ~95% of the code is dead arithmetic via Mixed Boolean-Arithmetic (MBA), control-flow flattening (a large while(1){switch(state)} state machine with XOR'd state values whose next-state computation is itself MBA-wrapped), and runtime stack-string construction that defeats FLOSS. Win32 APIs are resolved by DJB2 hashing (normal, lowercase, and Beacon-prefixed variants); Hell's Gate-style indirect syscalls are built by walking ntdll exports at startup and jumping to syscall gadgets. Ten anti-analysis checks (hypervisor, debugger via NtQueryInformationProcess, analysis-process name hashes, analysis window titles, sandbox drivers, RAM/CPU/uptime thresholds) are aggregated into a bitmask sent in the initial handshake.
C2: sessions perform an ephemeral ECDH P-256 key exchange (shared secret = SHA256 over the ECDH result concatenated with both public keys), derive an AES-256-GCM session key (random 12-byte nonces), and exchange framed packets over TLS/443 whose header begins with the magic bytes 'MLT' (0x014D4C54) followed by session_id, msg_type, payload_len, and nonce. A date-based DGA generates one distribution/C2 domain per day (e.g., 2026-04-29 -> rs2y15sungu.com).
The campaign also deploys ModeloRAT, a Python-based Windows RAT delivered via a portable WinPython package (WPy64-31401) run through a signed pythonw.exe, with RC4-encrypted C2, sequential failover across multiple independent C2 paths, a weekly domain-rotation DGA for non-domain-joined victims, and persistence via Run keys mimicking AnyDesk/Splashtop/Comms, Startup-folder shortcuts, VBScript launchers, and scheduled tasks. A .NET credential stealer presenting fake login screens accompanies Mistic. Hands-on tradecraft uses curl, reg.exe, net.exe, PowerShell, certutil, and WMIC, with Active Directory enumeration and Kerberoasting observed. Targeting spans insurance, education, IT, and professional-services sectors.
Target sectors: insurance, education, information technology, professional services
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 44 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1189, T1199, T1204.004, T1059.001, T1059.003, T1047, T1106, T1547.001, T1053.005