Threat reportMalwareTL-2026-2277
Backdoor.Mistic (MLTBackdoor): New Stealth Backdoor Linked to Woodgnat Ransomware Access Broker
Backdoor.Mistic (MLTBackdoor) (TL-2026-2277), also tracked as Backdoor.Mistic, is a high-severity malware campaign, first published 2026-06-24. It is attributed to Woodgnat with medium confidence, affects Microsoft Windows endpoints (DLL sideloading abuses the Microsoft, maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1053.005), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1Woodgnat
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-2277
- Threat ID
- TL-2026-2277
- Also known as
- Backdoor.Mistic, Mistic, MLTBackdoor
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Woodgnat
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- insurance, education, it, professional services
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Backdoor.Mistic (MLTBackdoor)
Malware and tooling: KillSwitch, KongTuke
How Backdoor.Mistic (MLTBackdoor) works
Symantec/Broadcom and Zscaler ThreatLabz identified a new stealthy Windows backdoor, Backdoor.Mistic (Zscaler: MLTBackdoor), deployed via DLL sideloading since at least April 2026. It executes C2-supplied code entirely in memory, loads Beacon Object Files, and self-deletes via a kill switch, and is assessed with medium confidence to be linked to Woodgnat (aka KongTuke), a financially motivated initial access broker that sells footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
Backdoor.Mistic is delivered by side-loading a malicious version.dll next to the legitimate Microsoft Defender component MpExtMs.exe; the loader hooks GetModuleFileNameW and LoadLibraryW to redirect execution into the actual payload DLL, EndpointDlp.dll, whose filename is deliberately chosen to resemble legitimate Microsoft endpoint-security tooling. In observed intrusions a companion .NET credential stealer displaying a fake login screen (f.dll) was dropped alongside it. Once running, Mistic operates entirely in memory: it can upload, download, move, rename, and delete files, create folders, adjust its C2 check-in interval, execute C2-supplied code with no file written to disk, and load Beacon Object Files (BOFs) to extend its capability set on demand. A built-in kill switch lets the operator terminate and self-delete the implant, removing forensic artifacts and enabling long-term, low-visibility access.
Mistic was observed deployed in close proximity to ModeloRAT, a Python-based RAT attributed to the financially motivated initial access broker Woodgnat (publicly also tracked as KongTuke, 404 TDS, Chaya_002, LandUpdate808, and TAG-124), which has been active since at least May 2024. Woodgnat's business model is to establish durable, stealthy enterprise access and sell it to ransomware affiliates rather than deploy a final payload itself; it has been publicly linked to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, and Symantec separately observed ModeloRAT infections followed by Qilin ransomware deployment. Delivery has evolved through a family of social-engineering pretexts the group iterates on: ClickFix (fake error/CAPTCHA prompts, early 2025), FileFix (Windows File Explorer address-bar manipulation, mid-2025), CrashFix (deliberately crashing the browser and offering a fake fix, flagged by Huntress in January 2026), a DNS-based staging variant disclosed by Microsoft in February 2026 that performs DNS lookups as a lightweight signaling/staging channel, and, from April 2026 onward, fake Microsoft Teams messages impersonating IT helpdesk staff (a pivot documented by Rapid7/ReliaQuest in May 2026). All variants ultimately deliver PowerShell that starts the infection chain. Woodgnat also operates a traffic-distribution system (TDS) built on compromised WordPress sites, and its wider toolkit includes a WinPython carrier, Node.exe for attacker JavaScript, finger.exe for retrieving obfuscated payloads, a malicious 'NexShield' Chrome extension, the GateKeeper .NET payload, and the MintsLoader and D3F@ck commodity loaders. Persistence is redundant: run-key entries masquerading as legitimate remote-access software (AnyDesk, Splashtop), startup-folder shortcuts, VBScript launchers, and scheduled tasks. C2 for the ModeloRAT side of the toolkit uses RC4-encrypted traffic over multiple independent, separately hosted C2 paths; non-domain-joined victims receive a heavily obfuscated variant that uses a domain-generation algorithm to cycle fresh C2 domains weekly, and exfiltration is performed over HTTP using curl.exe. Mistic has been observed targeting insurance, education, IT, and professional-services organizations in an opportunistic, non-sector-specific pattern consistent with an access broker casting a wide net and evaluating victims for resale value after compromise.
MITRE ATT&CK techniques used in TL-2026-2277
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL; T1684.001 Impersonation
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Credential Access
T1056.002 Input Capture: GUI Input Capture
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1071.004 Application Layer Protocol: DNS; T1568.002 Dynamic Resolution: Domain Generation Algorithms
defense-impairment
Resource Development
Affected products and versions in Backdoor.Mistic (MLTBackdoor)
- Microsoft — Windows endpoints (DLL sideloading abuses the Microsoft Defender component MpExtMs.exe)
Vulnerable versions: Any Windows environment where MpExtMs.exe is present and its DLL search order can be hijacked
Remediation for Backdoor.Mistic (MLTBackdoor)
Immediate actions
- Block the published Mistic/ModeloRAT C2 IP addresses and domains at the perimeter and DNS resolver layer
- Hunt for MpExtMs.exe execution outside its legitimate install path alongside a co-located version.dll or EndpointDlp.dll
- Isolate and forensically image any host showing this DLL sideloading pattern before the implant's self-deletion kill switch can trigger and remove artifacts
Workarounds
- Restrict non-administrator write access to the directory containing the legitimate MpExtMs.exe binary to prevent malicious DLL placement for sideloading
- Monitor and constrain curl.exe egress and DNS query patterns consistent with the DNS-based staging and domain-generation-algorithm C2 behavior documented for this toolkit
Longer-term hardening
- Deploy EDR/behavioral detection capable of flagging in-memory (fileless) code execution and Beacon Object File loading rather than relying on disk-based signatures
- Restrict or monitor external Microsoft Teams messaging to reduce exposure to unsolicited 'IT helpdesk' impersonation lures
- Run recurring user-awareness training specifically against ClickFix/FileFix/CrashFix-style fake-CAPTCHA and fake-browser-crash social engineering that instructs users to paste and run commands
Timeline of Backdoor.Mistic (MLTBackdoor)
- Woodgnat (KongTuke) initial access broker operations first tracked as active.
- KongTuke begins using ClickFix fake-error/CAPTCHA prompts to trick users into running PowerShell that delivers ModeloRAT.
- FileFix variant observed, manipulating the Windows File Explorer address bar to execute malicious commands.
- Huntress flags ModeloRAT delivered via a new CrashFix variant that deliberately crashes the victim's browser and offers a fake fix.
- Microsoft discloses a DNS-based ClickFix attack variant using DNS lookups as a lightweight staging/signaling channel.
- KongTuke begins using fake Microsoft Teams messages impersonating IT helpdesk staff to trigger the infection chain.
- Backdoor.Mistic first observed deployed in the wild via DLL sideloading (MpExtMs.exe loading version.dll, which loads EndpointDlp.dll).
- Zscaler ThreatLabz observes a multi-stage ClickFix chain delivering Mistic, which it tracks as MLTBackdoor.
- Rapid7/ReliaQuest report the group's pivot to Microsoft Teams-based social engineering.
- Symantec/Broadcom Threat Hunter Team publishes 'Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker,' detailing IOCs and the ModeloRAT/Woodgnat linkage.
- Wide security-press coverage (BleepingComputer, The Hacker News, SecurityAffairs, HelpNetSecurity, CSO Online, and others) links Mistic to KongTuke/Woodgnat and the ransomware affiliates it supplies.
Sources cited for Backdoor.Mistic (MLTBackdoor)
- Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
- New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Attacks
- Stealthy Mistic backdoor linked to ransomware access broker KongTuke
- Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions
- Stealthy new backdoor surfaces in attacks on multiple sectors
- Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs
- Be on the lookout for Mistic, a new backdoor used by ransomware broker
- Mistic: New Malware May Signal Evolution in Access Broker Tooling
Detection coverage for TL-2026-2277
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2277 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.