# Backdoor.Mistic (MLTBackdoor): New Stealth Backdoor Linked to Woodgnat Ransomware Access Broker

> Symantec/Broadcom and Zscaler ThreatLabz identified a new stealthy Windows backdoor, Backdoor.Mistic (Zscaler: MLTBackdoor), deployed via DLL sideloading since at least April 2026. It executes C2-supplied code entirely in memory, loads Beacon Object Files, and self-deletes via a kill switch, and is assessed with medium confidence to be linked to Woodgnat (aka KongTuke), a financially motivated initial access broker that sells footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2277
- **ID:** TL-2026-2277
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Woodgnat
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Backdoor.Mistic is delivered by side-loading a malicious version.dll next to the legitimate Microsoft Defender component MpExtMs.exe; the loader hooks GetModuleFileNameW and LoadLibraryW to redirect execution into the actual payload DLL, EndpointDlp.dll, whose filename is deliberately chosen to resemble legitimate Microsoft endpoint-security tooling. In observed intrusions a companion .NET credential stealer displaying a fake login screen (f.dll) was dropped alongside it. Once running, Mistic operates entirely in memory: it can upload, download, move, rename, and delete files, create folders, adjust its C2 check-in interval, execute C2-supplied code with no file written to disk, and load Beacon Object Files (BOFs) to extend its capability set on demand. A built-in kill switch lets the operator terminate and self-delete the implant, removing forensic artifacts and enabling long-term, low-visibility access.

Mistic was observed deployed in close proximity to ModeloRAT, a Python-based RAT attributed to the financially motivated initial access broker Woodgnat (publicly also tracked as KongTuke, 404 TDS, Chaya_002, LandUpdate808, and TAG-124), which has been active since at least May 2024. Woodgnat's business model is to establish durable, stealthy enterprise access and sell it to ransomware affiliates rather than deploy a final payload itself; it has been publicly linked to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, and Symantec separately observed ModeloRAT infections followed by Qilin ransomware deployment. Delivery has evolved through a family of social-engineering pretexts the group iterates on: ClickFix (fake error/CAPTCHA prompts, early 2025), FileFix (Windows File Explorer address-bar manipulation, mid-2025), CrashFix (deliberately crashing the browser and offering a fake fix, flagged by Huntress in January 2026), a DNS-based staging variant disclosed by Microsoft in February 2026 that performs DNS lookups as a lightweight signaling/staging channel, and, from April 2026 onward, fake Microsoft Teams messages impersonating IT helpdesk staff (a pivot documented by Rapid7/ReliaQuest in May 2026). All variants ultimately deliver PowerShell that starts the infection chain. Woodgnat also operates a traffic-distribution system (TDS) built on compromised WordPress sites, and its wider toolkit includes a WinPython carrier, Node.exe for attacker JavaScript, finger.exe for retrieving obfuscated payloads, a malicious 'NexShield' Chrome extension, the GateKeeper .NET payload, and the MintsLoader and D3F@ck commodity loaders. Persistence is redundant: run-key entries masquerading as legitimate remote-access software (AnyDesk, Splashtop), startup-folder shortcuts, VBScript launchers, and scheduled tasks. C2 for the ModeloRAT side of the toolkit uses RC4-encrypted traffic over multiple independent, separately hosted C2 paths; non-domain-joined victims receive a heavily obfuscated variant that uses a domain-generation algorithm to cycle fresh C2 domains weekly, and exfiltration is performed over HTTP using curl.exe. Mistic has been observed targeting insurance, education, IT, and professional-services organizations in an opportunistic, non-sector-specific pattern consistent with an access broker casting a wide net and evaluating victims for resale value after compromise.

## MITRE ATT&CK

- T1584.006 Compromise Infrastructure: Web Services
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1036 Masquerading
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1112 Modify Registry
- T1056.002 Input Capture: GUI Input Capture
- T1071.004 Application Layer Protocol: DNS
- T1568.002 Dynamic Resolution: Domain Generation Algorithms

## Sources

- [Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker](https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Attacks](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Stealthy Mistic backdoor linked to ransomware access broker KongTuke](https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/)
- [Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions](https://securityaffairs.com/194207/cyber-crime/inside-mistic-the-new-stealth-backdoor-in-ransomware-intrusions.html)
- [Stealthy new backdoor surfaces in attacks on multiple sectors](https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/)
- [Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs](https://hackread.com/woodgnat-hackers-mistic-rat-access-ransomware-gangs/)
- [Be on the lookout for Mistic, a new backdoor used by ransomware broker](https://www.csoonline.com/article/4189132/be-on-the-lookout-for-mistic-a-new-backdoor-used-by-ransomware-broker.html)
- [Mistic: New Malware May Signal Evolution in Access Broker Tooling](https://blog.polyswarm.io/mistic-new-malware-may-signal-evolution-in-access-broker-tooling)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2277