# Mistic Backdoor (MLTBackdoor) Impersonates Microsoft Endpoint Security via DLL Sideloading — Woodgnat/KongTuke Access Broker

> Mistic (aka Backdoor.Mistic, tracked by Zscaler as MLTBackdoor) is a fileless, in-memory backdoor that sideloads a malicious EndpointDlp.dll through the legitimate Microsoft executable MpExtMs.exe to impersonate endpoint-security tooling. It is deployed by the financially motivated initial-access broker Woodgnat (aka KongTuke, 404 TDS, Chaya_002, LandUpdate808, TAG-124), active since May 2024, which sells durable enterprise access to ransomware affiliates including Qilin, Akira, Rhysida, Black Basta, Interlock, and 8Base.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1038
- **ID:** TL-2026-1038
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Woodgnat
- **Detections:** 9 · **IOCs:** 51 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Backdoor.Mistic (publicly documented by Symantec's Threat Hunter Team on 2026-06-24/25 and originally tracked by Zscaler as MLTBackdoor) has been deployed since April 2026 against organizations in insurance, education, IT, and professional-services sectors in opportunistic, financially motivated intrusions. The infection chain begins with social-engineering lures delivered via compromised WordPress sites acting as a traffic distribution system (TDS), or via fake IT-helpdesk messages sent through Microsoft Teams (observed May 2026). Woodgnat/KongTuke has iterated its lure technique over time: ClickFix (early 2025, fake CAPTCHA/error prompts tricking victims into pasting scripts into the Windows Run dialog), FileFix (mid-2025, command execution via the Windows File Explorer address bar), and CrashFix (early 2026), in which a malicious Chrome extension named NexShield (masquerading as an ad blocker) deliberately crashes the victim's browser and presents a fake 'security scan' fix that runs attacker-supplied PowerShell.

Once a victim executes the PowerShell stage, the chain downloads a portable WinPython (WPy64-31401) environment used to run ModeloRAT, a Python-based remote access trojan believed to be co-developed by Woodgnat with ransomware affiliates (first identified by Huntress in January 2026 via a CrashFix variant tied to Qilin activity). ModeloRAT performs deep reconnaissance and credential harvesting using living-off-the-land binaries (net.exe, curl, certutil, WMIC, reg.exe) alongside commodity loaders such as MintsLoader and D3F@ck Loader, and a .NET payload dubbed GateKeeper.

Mistic itself is deployed via DLL sideloading: the legitimate Microsoft executable MpExtMs.exe is used to load a loader DLL, version.dll, which hooks the Windows API functions GetModuleFileNameW and LoadLibraryW to redirect execution to the malicious payload EndpointDlp.dll — named and structured to resemble genuine Microsoft endpoint-security components. The backdoor runs entirely in memory with no files written to disk, supports loading Beacon Object Files (BOFs) for dynamic capability expansion, and communicates over RC4-encrypted C2 traffic. It supports file upload/download, file move/rename/delete, folder creation, adjustable C2 check-in/poll intervals, and remote in-memory code execution, and includes a built-in kill switch that lets it erase itself once access has been sold or is no longer needed — directly undermining static file-based detection and forensic recovery.

Persistence is established redundantly via HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries disguised as legitimate remote-access software (AnyDesk, Splashtop, 'Comms'), Startup-folder shortcuts, VBScript launchers, and scheduled tasks. Post-compromise activity observed alongside Mistic and ModeloRAT includes domain enumeration via net.exe, Kerberoasting of service principal names, PowerShell-based host/service inventory, Active Directory querying, screenshot capture, and a secondary .NET credential-harvesting DLL (f.dll) that presents a fake Windows lock-screen to capture user credentials in cleartext.

Woodgnat/KongTuke is a financially motivated initial-access broker rather than a ransomware operator: its objective is to establish highly durable footholds inside victim networks and sell that access to ransomware affiliates and other criminal buyers. It has been publicly linked to Qilin, Akira, Rhysida, Black Basta, Interlock, and 8Base ransomware operations. DNS-based staging/signaling has also been observed as a lightweight alternative channel for payload retrieval and C2 tasking, complementing the WordPress-TDS and Teams-phishing delivery vectors.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1059.001 PowerShell
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.006 Python
- T1059.005 Visual Basic
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1176 Software Extensions
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1218.011 Rundll32
- T1056.004 Credential API Hooking
- T1558.003 Kerberoasting
- T1056.002 GUI Input Capture
- T1087.002 Domain Account
- T1007 System Service Discovery
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1071.004 DNS
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1584.004 Server
- T1587.001 Malware

## Sources

- [Mistic Backdoor Blends With Microsoft Endpoint Security](https://cybersecuritynews.com/mistic-backdoor-blends-with-microsoft-endpoint-security/)
- [Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker](https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat)
- [Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs](https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/)
- [Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker (Broadcom Protection Bulletin)](https://www.broadcom.com/support/security-center/protection-bulletin/backdoor-mistic-new-backdoor-may-be-linked-to-ransomware-access-broker)
- [ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker](https://gbhackers.com/modelorat-and-mistic-backdoor/)
- [Stealthy new backdoor surfaces in attacks on multiple sectors](https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/)
- [Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions](https://securityaffairs.com/194207/cyber-crime/inside-mistic-the-new-stealth-backdoor-in-ransomware-intrusions.html)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Stealthy Mistic backdoor linked to ransomware access broker KongTuke](https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/)
- [Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs](https://hackread.com/woodgnat-hackers-mistic-rat-access-ransomware-gangs/)
- [Fileless Ransomware Backdoor Mistic Erases Itself: Symantec Warns File Scans Will Miss It](https://www.techtimes.com/articles/319075/20260625/fileless-ransomware-backdoor-mistic-erases-itself-symantec-warns-file-scans-will-miss-it.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1038