Mistic Backdoor (MLTBackdoor) Impersonates Microsoft Endpoint Security via DLL Sideloading — Woodgnat/KongTuke Access Broker
Mistic Backdoor (MLTBackdoor) Impersonates Microsoft (TL-2026-1038), also tracked as Backdoor.Mistic, is a high-severity malware campaign, first published 2026-07-01. It is attributed to Woodgnat with high confidence, affects Microsoft Windows (MpExtMs.exe / Microsoft Defender endpoint-security, maps to 32 MITRE ATT&CK techniques (T1005, T1007, T1018), and is covered by 9 detection rules and 51 indicators of compromise.
Key facts for TL-2026-1038
- Threat ID
- TL-2026-1038
- Also known as
- Backdoor.Mistic, MLTBackdoor
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution
- Woodgnat
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- insurance, education, information technology, professional services
- Target regions
- Unknown / opportunistic global targeting
- Detection rules
- 9
- Indicators of compromise
- 51
Malware and tooling in Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
Malware and tooling: D3F@ck Loader, GateKeeper, MintsLoader, Mistic, ModeloRAT, NexShield
Mistic (aka Backdoor.Mistic, tracked by Zscaler as MLTBackdoor) is a fileless, in-memory backdoor that sideloads a malicious EndpointDlp.dll through the legitimate Microsoft executable MpExtMs.exe to impersonate endpoint-security tooling. It is deployed by the financially motivated initial-access broker Woodgnat (aka KongTuke, 404 TDS, Chaya_002, LandUpdate808, TAG-124), active since May 2024, which sells durable enterprise access to ransomware affiliates including Qilin, Akira, Rhysida, Black Basta, Interlock, and 8Base.
How Mistic Backdoor (MLTBackdoor) Impersonates Microsoft works
Backdoor.Mistic (publicly documented by Symantec's Threat Hunter Team on 2026-06-24/25 and originally tracked by Zscaler as MLTBackdoor) has been deployed since April 2026 against organizations in insurance, education, IT, and professional-services sectors in opportunistic, financially motivated intrusions. The infection chain begins with social-engineering lures delivered via compromised WordPress sites acting as a traffic distribution system (TDS), or via fake IT-helpdesk messages sent through Microsoft Teams (observed May 2026). Woodgnat/KongTuke has iterated its lure technique over time: ClickFix (early 2025, fake CAPTCHA/error prompts tricking victims into pasting scripts into the Windows Run dialog), FileFix (mid-2025, command execution via the Windows File Explorer address bar), and CrashFix (early 2026), in which a malicious Chrome extension named NexShield (masquerading as an ad blocker) deliberately crashes the victim's browser and presents a fake 'security scan' fix that runs attacker-supplied PowerShell.
Once a victim executes the PowerShell stage, the chain downloads a portable WinPython (WPy64-31401) environment used to run ModeloRAT, a Python-based remote access trojan believed to be co-developed by Woodgnat with ransomware affiliates (first identified by Huntress in January 2026 via a CrashFix variant tied to Qilin activity). ModeloRAT performs deep reconnaissance and credential harvesting using living-off-the-land binaries (net.exe, curl, certutil, WMIC, reg.exe) alongside commodity loaders such as MintsLoader and D3F@ck Loader, and a .NET payload dubbed GateKeeper.
Mistic itself is deployed via DLL sideloading: the legitimate Microsoft executable MpExtMs.exe is used to load a loader DLL, version.dll, which hooks the Windows API functions GetModuleFileNameW and LoadLibraryW to redirect execution to the malicious payload EndpointDlp.dll — named and structured to resemble genuine Microsoft endpoint-security components. The backdoor runs entirely in memory with no files written to disk, supports loading Beacon Object Files (BOFs) for dynamic capability expansion, and communicates over RC4-encrypted C2 traffic. It supports file upload/download, file move/rename/delete, folder creation, adjustable C2 check-in/poll intervals, and remote in-memory code execution, and includes a built-in kill switch that lets it erase itself once access has been sold or is no longer needed — directly undermining static file-based detection and forensic recovery.
Persistence is established redundantly via HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries disguised as legitimate remote-access software (AnyDesk, Splashtop, 'Comms'), Startup-folder shortcuts, VBScript launchers, and scheduled tasks. Post-compromise activity observed alongside Mistic and ModeloRAT includes domain enumeration via net.exe, Kerberoasting of service principal names, PowerShell-based host/service inventory, Active Directory querying, screenshot capture, and a secondary .NET credential-harvesting DLL (f.dll) that presents a fake Windows lock-screen to capture user credentials in cleartext.
Woodgnat/KongTuke is a financially motivated initial-access broker rather than a ransomware operator: its objective is to establish highly durable footholds inside victim networks and sell that access to ransomware affiliates and other criminal buyers. It has been publicly linked to Qilin, Akira, Rhysida, Black Basta, Interlock, and 8Base ransomware operations. DNS-based staging/signaling has also been observed as a lightweight alternative channel for payload retrieval and C2 tasking, complementing the WordPress-TDS and Teams-phishing delivery vectors.
MITRE ATT&CK techniques used in TL-2026-1038
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1007 System Service Discovery; T1018 Remote System Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Persistence
T1053.005 Scheduled Task; T1176 Software Extensions; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1056.002 GUI Input Capture; T1056.004 Credential API Hooking; T1558.003 Kerberoasting
Command and Control
T1071.004 DNS; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
stealth
Resource Development
Affected products and versions in Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
- Microsoft — Windows (MpExtMs.exe / Microsoft Defender endpoint-security tooling impersonation)
Vulnerable versions: all supported Windows versions where MpExtMs.exe is present
Remediation for Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
Immediate actions
- Block the listed C2 IPs (142.93.242.144, 144.31.53.78, 198.13.159.44, 199.91.221.42) and domains at perimeter firewall/DNS sinkhole
- Hunt for MpExtMs.exe loading a non-standard version.dll or EndpointDlp.dll and quarantine affected hosts
- Search for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries impersonating AnyDesk, Splashtop, or 'Comms' and remove unauthorized persistence
- Reset credentials for any host where the fake lock-screen credential harvester (f.dll) may have executed
- Force Kerberos service account password rotation on any host showing Kerberoasting-pattern SPN requests
Workarounds
- Disable the Windows Run dialog and File Explorer address-bar command execution via GPO for high-risk user groups to blunt ClickFix/FileFix delivery
- Restrict user ability to install unmanaged browser extensions to blunt the CrashFix/NexShield vector
Longer-term hardening
- Deploy EDR/behavioral detection tuned for in-memory execution and DLL sideloading of signed Microsoft binaries
- Restrict or monitor execution of portable Python (WinPython) archives and interpreters from user-writable directories
- Implement browser/extension allowlisting to block unauthorized Chrome extensions such as NexShield
- Harden Microsoft Teams external messaging policies to reduce fake IT-helpdesk phishing exposure
- Deploy DNS monitoring/analytics to detect DNS-based C2 staging and signaling channels
Weaknesses (CWE) in Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
CWE-506, CWE-434, CWE-1021
Timeline of Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
- Woodgnat (aka KongTuke) initial-access-broker operation begins activity, tracked as a financially motivated group operating a WordPress-based traffic distribution system.
- Woodgnat begins using ClickFix lures — fake CAPTCHA/error prompts tricking victims into pasting malicious scripts into the Windows Run dialog.
- Group evolves lure delivery to FileFix, abusing the Windows File Explorer address bar to execute attacker commands.
- Woodgnat begins CrashFix campaigns using the malicious NexShield Chrome extension to deliberately crash victim browsers and prompt fake security-scan fixes that execute PowerShell.
- Huntress first identifies ModeloRAT in connection with a CrashFix ClickFix variant tied to Qilin ransomware activity.
- Initial ModeloRAT and Node.js-based activity observed in intrusions preceding widespread Mistic deployment.
- Backdoor.Mistic (MLTBackdoor) deployment begins in the wild, observed alongside ModeloRAT in intrusions against insurance, education, IT, and professional-services organizations.
- Woodgnat pivots to fake IT-helpdesk messages sent via Microsoft Teams to push victims into running PowerShell commands leading to ModeloRAT deployment.
- The Hacker News publishes 'New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns.'
- Cyber Security News publishes coverage of Mistic backdoor blending with Microsoft endpoint security tooling, citing Zscaler's original MLTBackdoor tracking and a shared Symantec report.
- Additional outlets (The Register, BleepingComputer, HelpNetSecurity, GBHackers, SecurityAffairs, HackRead, TechTimes) republish and expand on the Symantec findings.
- Symantec's Threat Hunter Team (Broadcom/security.com) publishes the full Backdoor.Mistic analysis linking the malware to the Woodgnat access broker and ModeloRAT.
Sources cited for Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
- Mistic Backdoor Blends With Microsoft Endpoint Security
- Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
- Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs
- Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker (Broadcom Protection Bulletin)
- ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker
- Stealthy new backdoor surfaces in attacks on multiple sectors
- Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions
- New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
- Stealthy Mistic backdoor linked to ransomware access broker KongTuke
- Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs
- Fileless Ransomware Backdoor Mistic Erases Itself: Symantec Warns File Scans Will Miss It
Threats related to Mistic Backdoor (MLTBackdoor) Impersonates Microsoft
- Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT
- Backdoor.Mistic (MLTBackdoor): New Stealth Backdoor Linked to Woodgnat Ransomware Access Broker
- Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- Mistic Windows Backdoor - In-Memory Code Execution via DLL Sideloading
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading
Detection coverage for TL-2026-1038
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1038 across Splunk SPL, Microsoft KQL and Sigma, covering 51 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1038
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.