# Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions

> Mistic (tracked as MLTBackdoor by Zscaler ThreatLabz) is a sophisticated in-memory Windows backdoor active since April 2026, delivered via ClickFix/FileFix social-engineering chains and DLL side-loading using the legitimate signed Microsoft Defender binary MpExtMs.exe. The KongTuke initial access broker (also known as Woodgnat/TAG-124) deploys Mistic alongside the Python-based ModeloRAT to profile corporate environments, then sells persistent footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Targeted sectors include insurance, education, IT services, and professional services across North America and Europe.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0967
- **ID:** TL-2026-0967
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** KongTuke
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Mistic (Symantec designation: Backdoor.Mistic; Zscaler designation: Win64.Backdoor.MLTBackdoor) is a highly evasive Windows backdoor first observed in April 2026 by Symantec Threat Hunter Team, with coordinated public disclosure by both Symantec/Broadcom and Zscaler ThreatLabz on June 25, 2026. The malware is attributed to KongTuke, a financially motivated initial access broker (IAB) also tracked as Woodgnat, TAG-124, 404 TDS, Chaya_002, and LandUpdate808 — active since at least May 2024.

The KongTuke infection chain relies on three primary lure mechanisms: ClickFix (fake browser errors on compromised WordPress pages), FileFix (malicious file-open prompts), and CrashFix (a malicious NexShield browser extension that intentionally crashes Chrome then presents a fake fix). In the Teams-based vector, attackers use spoofed Microsoft 365 tenants (e.g., officeupdates366.onmicrosoft.com) with Unicode display-name spoofing to impersonate IT help desks and convince victims to execute PowerShell commands. Web-based lures direct victims to paste a conhost.exe/curl command into the Windows Run dialog, downloading a compressed archive from an attacker C2.

The delivery archive contains data.bin (RC4-encrypted MLTBackdoor payload) and endpointdlp.dll (the stage-one loader). The loader decrypts the payload using a 32-byte RC4 key embedded in the payload header, then initiates DLL side-loading: the legitimate signed Microsoft binary MpExtMs.exe is placed in the working directory alongside a malicious version.dll (which hooks GetModuleFileNameW and LoadLibraryW) to load the Mistic payload (EndpointDlp.dll). This masquerades as Microsoft Endpoint Data Loss Prevention tooling. A self-update mechanism pulls from powwowski.com/payloads/update.zip. Mistic operates entirely in memory — it writes no persistent files — and includes a kill-switch command (message type 4: Exit process) that self-terminates and deletes all components from disk, enabling seamless access handoff to ransomware purchasers.

Mistic's C2 protocol uses TLS on port 443 with the endpoint path /api/v1/telemetry and blends in using the User-Agent string 'Microsoft-Delivery-Optimization/10.1'. Key exchange uses ECDH on NIST P-256; session payloads are AES-256-GCM encrypted with a random 12-byte nonce per message. Every packet carries a 4-byte magic header (0x014D4C54 = '\x01MLT'). Supported commands include file upload/download/move/delete/mkdir/list, polling frequency adjustment, in-memory BOF (Beacon Object File) execution, and self-termination. A date-based DGA (LCG with multiplier 0x0019660D and increment 0x3C6EF35F, seeded by YYYYMMDD) generates one new .com domain per day as a fallback C2.

Obfuscation is sophisticated and multi-layered: Mixed Boolean-Arithmetic (MBA) rewrites arithmetic operations into multi-step bitwise equivalents producing ~95% junk code; Control Flow Flattening (CFF) replaces all conditionals with while(1)/switch(state) dispatch loops with XOR-obscured state values; strings are constructed byte-by-byte at runtime across flattened state machines; Windows APIs are resolved at runtime by DJB2 hash (e.g., WinHttpConnect → 0x7242C17D); and 31 NT syscalls are dispatched via a Hell's Gate-style indirect syscall table. Anti-analysis uses a 10-bit bitmask checking hypervisor presence (VMware/VBox/Xen/KVM), timing (RDTSC+CPUID loops), debugger (NtQueryInformationProcess), SHA256 hashes of running analysis-tool processes, window titles, driver names, RAM size (<2GB), CPU count (single-core), and system uptime (<5 minutes).

KongTuke also deploys ModeloRAT, a Python-based RAT using portable WinPython (WPy64-31401) deployed to %APPDATA%\Roaming. ModeloRAT's Pmanager.py uses RC4+zlib over HTTP:80 with a five-server failover C2 pool, beaconing every 300 seconds. It creates four redundant persistence mechanisms: a Registry Run Key (MonitoringService), a Startup folder LNK shortcut (StartManagerB.lnk), a VBScript launcher (scriptA.vbs), and a SYSTEM-level scheduled task named ChromeA or AdobeA. The collector module (collector.py) profiles domain-joined status, runs net.exe/PowerShell LDAP enumeration of AD users/groups/computers, enumerates running processes/services/AV via WMI SecurityCenter2, and dumps results to configA.json. A credential harvesting module (f.dll) displays a fake Windows login screen; an escalation module (n.dll) handles privilege elevation. The CrashFix campaign adds a malicious NexShield Chrome extension (ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) that iterates 1e9 Chrome runtime port connections to deliberately crash the browser, then delivers a .NET GateKeeper payload via finger.exe LOLBin for non-domain-joined targets.

Once a corporate foothold is profiled, KongTuke sells access to ransomware affiliates. Linked ransomware groups include Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The access broker is known to rotate across at least five Microsoft 365 tenants over 45-day periods and operates C2 through a mix of hardcoded IPs/domains and daily-rotating DGA domains.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1189 Drive-by Compromise
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1574 Hijack Execution Flow
- T1056 Input Capture
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1012 Query Registry
- T1087 Account Discovery
- T1135 Network Share Discovery
- T1518 Software Discovery
- T1016 System Network Configuration Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1568 Dynamic Resolution
- T1104 Multi-Stage Channels

## Sources

- [Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs](https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579)
- [Technical Analysis of MLTBackdoor — Zscaler ThreatLabz](https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor)
- [Backdoor.Mistic: New Backdoor May Be Linked to Ransomware Access Broker — Symantec/Broadcom](https://www.broadcom.com/support/security-center/protection-bulletin/backdoor-mistic-new-backdoor-may-be-linked-to-ransomware-access-broker)
- [Backdoor.Mistic: New Backdoor May Be Linked to Ransomware Access Broker — security.com](https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns — The Hacker News](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Stealthy Mistic Backdoor Linked to Ransomware Access Broker KongTuke — BleepingComputer](https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/)
- [CrashFix: KongTuke's New Toy — Huntress](https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke)
- [Help-Desk Lures Drop KongTuke's Evolved ModeloRAT — ReliaQuest](https://reliaquest.com/blog/threat-spotlight-help-desk-lures-drop-kongtukes-evolved-modelorat/)
- [KongTuke YARA Rules — RussianPanda95 GitHub](https://github.com/RussianPanda95/Yara-Rules/tree/main/KongTuke)
- [Inside Mistic: The New Stealth Backdoor in Ransomware Intrusions — Security Affairs](https://securityaffairs.com/194207/cyber-crime/inside-mistic-the-new-stealth-backdoor-in-ransomware-intrusions.html)
- [Woodgnat Uses ClickFix, FileFix, and CrashFix Lures — Cyberpress](https://cyberpress.org/woodgnat-fix-lure-malware/)
- [Mistic Backdoor Blends With Microsoft Endpoint Security Tooling — CyberSecurityNews](https://cybersecuritynews.com/mistic-backdoor-blends-with-microsoft-endpoint-security/)
- [Stealthy New Backdoor Surfaces in Attacks — Help Net Security](https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0967