Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT
Backdoor.Mistic (MLTBackdoor) (TL-2026-0933), also tracked as MLTBackdoor, is a high-severity malware campaign, first published 2026-06-24. It is attributed to Woodgnat with medium confidence, affects Microsoft Windows, maps to 36 MITRE ATT&CK techniques (T1008, T1016, T1018), and is covered by 9 detection rules and 44 indicators of compromise.
Key facts for TL-2026-0933
- Threat ID
- TL-2026-0933
- Also known as
- MLTBackdoor, Mistic
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-24
- Last reviewed
- 2026-06-24
- Attribution
- Woodgnat
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- insurance, education, information technology, professional services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 44
Malware and tooling in Backdoor.Mistic (MLTBackdoor)
Malware and tooling: Backdoor.Mistic, MLTBackdoor, ModeloRAT, MLT-protocol BOF C2 (ECDH P-256 + AES-256-GCM over TLS/443)
Backdoor.Mistic (tracked as MLTBackdoor by Zscaler ThreatLabz) is a heavily obfuscated, in-memory backdoor with Beacon Object File (BOF) execution and a kill-switch self-delete, deployed since April 2026 by the financially motivated initial access broker Woodgnat (aka KongTuke / TAG-124 / LandUpdate808 / Chaya_002 / 404 TDS). It is DLL-sideloaded via the legitimate Microsoft executable mpextms.exe and masquerades as Microsoft endpoint-security tooling. Woodgnat sells the resulting enterprise access to ransomware operations including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
How Backdoor.Mistic (MLTBackdoor) works
Backdoor.Mistic — tracked independently as MLTBackdoor by Zscaler ThreatLabz — is a custom in-memory backdoor first observed in April 2026 and reported by Symantec/Security.com on 24 June 2026. It is deployed by Woodgnat (Symantec naming), the same actor cluster Zscaler and others track as KongTuke / TAG-124 / LandUpdate808 / Chaya_002 / 404 TDS, a financially motivated initial access broker (IAB) and traffic distribution system (TDS) active since May 2024.
Infection chain: victims reach a ClickFix-style lure (an automotive-themed webpage in the Zscaler chain, and helpdesk/IT-support pretexts delivered through external Microsoft Teams chats from April 2026 onward). The lure preloads a command to the clipboard and instructs the user to paste-and-run it. PowerShell/cmd then creates a temp directory and uses curl to download a compressed archive containing data.bin (an RC4-encrypted payload, key in the payload header) and a loader DLL (endpointdlp.dll). After a self-update, Mistic is sideloaded via the legitimate Windows binary mpextms.exe: a loader (version.dll) hooks GetModuleFileNameW (to redirect path queries to the legitimate mpextms.exe location) and LoadLibraryW (to load the malicious EndpointDlp.dll containing Mistic). The DLL name impersonates Microsoft endpoint-security tooling to blend with trusted software.
Capabilities: file upload/download, file move/rename/delete, folder creation, command check-frequency modification, in-memory payload execution without disk writes, and self-termination/self-deletion via a kill switch. A full COFF/BOF loader allocates memory per section, walks the symbol table and applies relocations, sets sections RX-only, resolves 7 standard Beacon imports plus 19 additional syscall wrappers (NtCreateFile, NtReadFile, NtWriteFile, registry ops), and executes Beacon Object Files to extend functionality at runtime.
Evasion: ~95% of the code is dead arithmetic via Mixed Boolean-Arithmetic (MBA), control-flow flattening (a large while(1){switch(state)} state machine with XOR'd state values whose next-state computation is itself MBA-wrapped), and runtime stack-string construction that defeats FLOSS. Win32 APIs are resolved by DJB2 hashing (normal, lowercase, and Beacon-prefixed variants); Hell's Gate-style indirect syscalls are built by walking ntdll exports at startup and jumping to syscall gadgets. Ten anti-analysis checks (hypervisor, debugger via NtQueryInformationProcess, analysis-process name hashes, analysis window titles, sandbox drivers, RAM/CPU/uptime thresholds) are aggregated into a bitmask sent in the initial handshake.
C2: sessions perform an ephemeral ECDH P-256 key exchange (shared secret = SHA256 over the ECDH result concatenated with both public keys), derive an AES-256-GCM session key (random 12-byte nonces), and exchange framed packets over TLS/443 whose header begins with the magic bytes 'MLT' (0x014D4C54) followed by session_id, msg_type, payload_len, and nonce. A date-based DGA generates one distribution/C2 domain per day (e.g., 2026-04-29 -> rs2y15sungu.com).
The campaign also deploys ModeloRAT, a Python-based Windows RAT delivered via a portable WinPython package (WPy64-31401) run through a signed pythonw.exe, with RC4-encrypted C2, sequential failover across multiple independent C2 paths, a weekly domain-rotation DGA for non-domain-joined victims, and persistence via Run keys mimicking AnyDesk/Splashtop/Comms, Startup-folder shortcuts, VBScript launchers, and scheduled tasks. A .NET credential stealer presenting fake login screens accompanies Mistic. Hands-on tradecraft uses curl, reg.exe, net.exe, PowerShell, certutil, and WMIC, with Active Directory enumeration and Kerberoasting observed. Targeting spans insurance, education, IT, and professional-services sectors.
MITRE ATT&CK techniques used in TL-2026-0933
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1568.002 Domain Generation Algorithms; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography
Discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1082 System Information Discovery; T1087 Account Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1106 Native API; T1204.004 Malicious Copy and Paste
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1056.002 GUI Input Capture; T1558.003 Kerberoasting
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1189 Drive-by Compromise; T1199 Trusted Relationship; T1566 Phishing
Impact
T1486 Data Encrypted for Impact
stealth
Affected products and versions in Backdoor.Mistic (MLTBackdoor)
- Microsoft — Windows
Vulnerable versions: Windows (x64 endpoints)
Remediation for Backdoor.Mistic (MLTBackdoor)
Immediate actions
- Block the listed C2 IPs, domains, and the DGA-pattern infrastructure at the perimeter and DNS resolver
- Hunt for sideloading of mpextms.exe loading non-Microsoft EndpointDlp.dll / version.dll from unexpected paths
- Alert on ClickFix/FileFix/CrashFix behavior: clipboard paste into Run/File Explorer/Terminal spawning PowerShell or curl
- Restrict and monitor inbound external Microsoft Teams chats; treat helpdesk/IT-support pretexts as suspicious
Workarounds
- Block macro-free LOLBin abuse (certutil download/decode, curl, WMIC) where not operationally required
- Network-segment and egress-filter to constrain C2 over TLS/443 to known destinations
Longer-term hardening
- Deploy EDR with behavioral and in-memory/BOF detection rather than signature-only AV
- Disable or tightly control clipboard-to-shell execution paths and the Windows Run/File Explorer command vectors
- Enforce application allow-listing (WDAC/AppLocker) and DLL load-path hardening to defeat sideloading
- Harden Active Directory against Kerberoasting (managed service accounts, strong/long passwords, AES-only)
Timeline of Backdoor.Mistic (MLTBackdoor)
- Woodgnat / KongTuke (TAG-124, LandUpdate808, Chaya_002, 404 TDS) assessed active as an initial access broker and traffic distribution system.
- KongTuke switches to ClickFix lures (FakeCAPTCHA), preloading clipboard commands for victims to paste-and-run.
- FileFix variation of ClickFix published (MrD0x); KongTuke begins leveraging the File Explorer address bar to execute commands.
- The DFIR Report documents KongTuke FileFix leading to a new Interlock RAT variant.
- CrashFix method (deliberate browser crashes via malicious browser extension) observed delivering ModeloRAT (Huntress).
- Backdoor.Mistic / MLTBackdoor deployment begins; Woodgnat adopts helpdesk/IT-support pretexts over external Microsoft Teams chats for initial access.
- Date-based DGA observed generating distribution/C2 domain rs2y15sungu.com for that day.
- Zscaler ThreatLabz identifies and names the family MLTBackdoor, delivered via a multi-stage ClickFix chain.
- Symantec / Security.com publishes 'New Mistic Backdoor and ModeloRAT Deployed by Woodgnat Initial Access Broker'.
Sources cited for Backdoor.Mistic (MLTBackdoor)
- New Mistic Backdoor and ModeloRAT Deployed by Woodgnat Initial Access Broker
- Technical Analysis of MLTBackdoor (Zscaler ThreatLabz)
- Dissecting CrashFix: KongTuke's New Toy (Huntress)
- KongTuke FileFix Leads to New Interlock RAT Variant (The DFIR Report)
- KongTuke: A King Among Threat Groups (LevelBlue/SpiderLabs)
- KongTuke Investigation Report (Breakglass Intelligence)
- KongTuke hackers now use Microsoft Teams for corporate breaches (BleepingComputer)
- Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware (GBHackers)
Threats related to Backdoor.Mistic (MLTBackdoor)
- Mistic Backdoor (MLTBackdoor) Impersonates Microsoft Endpoint Security via DLL Sideloading — Woodgnat/KongTuke Access Broker
- Backdoor.Mistic (MLTBackdoor): New Stealth Backdoor Linked to Woodgnat Ransomware Access Broker
- Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading
- Mistic Windows Backdoor - In-Memory Code Execution via DLL Sideloading
Detection coverage for TL-2026-0933
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0933 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0933
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.