# Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT

> Backdoor.Mistic (tracked as MLTBackdoor by Zscaler ThreatLabz) is a heavily obfuscated, in-memory backdoor with Beacon Object File (BOF) execution and a kill-switch self-delete, deployed since April 2026 by the financially motivated initial access broker Woodgnat (aka KongTuke / TAG-124 / LandUpdate808 / Chaya_002 / 404 TDS). It is DLL-sideloaded via the legitimate Microsoft executable mpextms.exe and masquerades as Microsoft endpoint-security tooling. Woodgnat sells the resulting enterprise access to ransomware operations including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0933
- **ID:** TL-2026-0933
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Woodgnat
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Backdoor.Mistic — tracked independently as MLTBackdoor by Zscaler ThreatLabz — is a custom in-memory backdoor first observed in April 2026 and reported by Symantec/Security.com on 24 June 2026. It is deployed by Woodgnat (Symantec naming), the same actor cluster Zscaler and others track as KongTuke / TAG-124 / LandUpdate808 / Chaya_002 / 404 TDS, a financially motivated initial access broker (IAB) and traffic distribution system (TDS) active since May 2024.

Infection chain: victims reach a ClickFix-style lure (an automotive-themed webpage in the Zscaler chain, and helpdesk/IT-support pretexts delivered through external Microsoft Teams chats from April 2026 onward). The lure preloads a command to the clipboard and instructs the user to paste-and-run it. PowerShell/cmd then creates a temp directory and uses curl to download a compressed archive containing data.bin (an RC4-encrypted payload, key in the payload header) and a loader DLL (endpointdlp.dll). After a self-update, Mistic is sideloaded via the legitimate Windows binary mpextms.exe: a loader (version.dll) hooks GetModuleFileNameW (to redirect path queries to the legitimate mpextms.exe location) and LoadLibraryW (to load the malicious EndpointDlp.dll containing Mistic). The DLL name impersonates Microsoft endpoint-security tooling to blend with trusted software.

Capabilities: file upload/download, file move/rename/delete, folder creation, command check-frequency modification, in-memory payload execution without disk writes, and self-termination/self-deletion via a kill switch. A full COFF/BOF loader allocates memory per section, walks the symbol table and applies relocations, sets sections RX-only, resolves 7 standard Beacon imports plus 19 additional syscall wrappers (NtCreateFile, NtReadFile, NtWriteFile, registry ops), and executes Beacon Object Files to extend functionality at runtime.

Evasion: ~95% of the code is dead arithmetic via Mixed Boolean-Arithmetic (MBA), control-flow flattening (a large while(1){switch(state)} state machine with XOR'd state values whose next-state computation is itself MBA-wrapped), and runtime stack-string construction that defeats FLOSS. Win32 APIs are resolved by DJB2 hashing (normal, lowercase, and Beacon-prefixed variants); Hell's Gate-style indirect syscalls are built by walking ntdll exports at startup and jumping to syscall gadgets. Ten anti-analysis checks (hypervisor, debugger via NtQueryInformationProcess, analysis-process name hashes, analysis window titles, sandbox drivers, RAM/CPU/uptime thresholds) are aggregated into a bitmask sent in the initial handshake.

C2: sessions perform an ephemeral ECDH P-256 key exchange (shared secret = SHA256 over the ECDH result concatenated with both public keys), derive an AES-256-GCM session key (random 12-byte nonces), and exchange framed packets over TLS/443 whose header begins with the magic bytes 'MLT' (0x014D4C54) followed by session_id, msg_type, payload_len, and nonce. A date-based DGA generates one distribution/C2 domain per day (e.g., 2026-04-29 -> rs2y15sungu.com).

The campaign also deploys ModeloRAT, a Python-based Windows RAT delivered via a portable WinPython package (WPy64-31401) run through a signed pythonw.exe, with RC4-encrypted C2, sequential failover across multiple independent C2 paths, a weekly domain-rotation DGA for non-domain-joined victims, and persistence via Run keys mimicking AnyDesk/Splashtop/Comms, Startup-folder shortcuts, VBScript launchers, and scheduled tasks. A .NET credential stealer presenting fake login screens accompanies Mistic. Hands-on tradecraft uses curl, reg.exe, net.exe, PowerShell, certutil, and WMIC, with Active Directory enumeration and Kerberoasting observed. Targeting spans insurance, education, IT, and professional-services sectors.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1199 Trusted Relationship
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1068 Exploitation for Privilege Escalation
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1070.004 File Deletion
- T1218.007 Msiexec
- T1056.002 GUI Input Capture
- T1558.003 Kerberoasting
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1573.001 Symmetric Cryptography
- T1568.002 Domain Generation Algorithms
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [New Mistic Backdoor and ModeloRAT Deployed by Woodgnat Initial Access Broker](https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat)
- [Technical Analysis of MLTBackdoor (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor)
- [Dissecting CrashFix: KongTuke's New Toy (Huntress)](https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke)
- [KongTuke FileFix Leads to New Interlock RAT Variant (The DFIR Report)](https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/)
- [KongTuke: A King Among Threat Groups (LevelBlue/SpiderLabs)](https://www.levelblue.com/blogs/spiderlabs-blog/kongtuke-a-king-among-threat-groups)
- [KongTuke Investigation Report (Breakglass Intelligence)](https://intel.breakglass.tech/post/kongtuke-investigation-report)
- [KongTuke hackers now use Microsoft Teams for corporate breaches (BleepingComputer)](https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/)
- [Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware (GBHackers)](https://gbhackers.com/mltbackdoor-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0933