Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker

A relatively new backdoor that we have called Backdoor.Mistic has been deployed in multiple attacks since April 2026. The backdoor was first documented by Zscaler (which tracks it as MLTBackdoor) earlier this month. Mistic may be linked to the financially motivated initial access broker (IAB) tracked publicly as KongTuke (which we track as Woodgnat) and it was used in one intrusion that also involved the group's ModeloRAT remote access trojan.

Woodgnat reportedly functions primarily as an IAB. Its goal is not to deliver the final payload, but to establish highly durable remote access within an enterprise and sell this high-level access to ransomware affiliates and other attackers for a fee. The Symantec Threat Hunter Team has observed ModeloRAT being used in attacks delivering the Qilin ransomware.

Mistic was first seen in April 2026. It has been deployed on the networks of organizations in a range of sectors, including insurance, education, IT and professional services. Other ModeloRAT and Node.js activity that is likely linked to the same actors was seen at some other organizations from February 2026, but Mistic was not deployed in those incidents. The targeting appears to be opportunistic, with the attackers casting a wide net and then assessing which organizations they could sell access to rather than focusing on a single sector.

The backdoor can run remote payloads directly in memory. It also has typical backdoor capabilities, including:

The backdoor is launched via sideloading. In a recent attack investigated by the Symantec Threat Hunter Team , MpExtMs.exe, a legitimate file, was used to sideload malicious DLLs. A loader (version.dll) hooks GetModuleFileNameW and LoadLibraryW. The GetModuleFileNameW hook makes sure that the path mpextms.exe is pointed to the legitimate location of mpextms.exe. The LoadLibraryW hook makes sure it loads the malicious EndpointDlp.dll, which is Backdoor.Mistic. A .NET DLL is also loaded on the victim network. This is a credential stealer that displays a fake login screen.

In addition to Mistic and ModeloRAT, other tools used in that attack included:

The fact that Mistic executes in memory and also has a kill switch built in means that it is very stealthy, potentially allowing for long-term, stealthy access for attackers.

Woodgnat is a financially motivated cybercrime operation that has been active since at least May 2024. It has been publicly linked to multiple ransomware operations, including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta. Its malicious traffic distribution system is mainly built on compromised WordPress sites, which it uses to deliver an evolving series of social-engineering lures that trick users into executing attacker-supplied commands.

The group is believed to gain control of these sites through a combination of vulnerable or misconfigured plugins, stolen or purchased credentials, and phishing. Injected JavaScript profiles site visitors and serves social-engineering lures that have evolved over time.

Zscaler reported that Mistic was being delivered via a ClickFix infection chain, another low-confidence link that suggests Mistic may be linked to Woodgnat.

In each case the victim is ultimately tricked into running an attacker-supplied PowerShell command. While the initial compromise may be opportunistic, the attackers profile the machines for potential interest to determine their value and if they can sell access to them.

Since around April 2026, Woodgnat has also been observed using helpdesk and IT-support pretexts delivered through external Microsoft Teams chats to walk targeted users through a “paste-and-run” sequence. In reported cases the operator rotated through multiple Microsoft 365 tenants over an extended period to blunt reactive blocking and reached persistent access within minutes of the victim pasting a single PowerShell command.

Woodgnat is most readily identified through its use of ModeloRAT, which is typically delivered as part of a portable WinPython package and run via a signed pythonw.exe interpreter, with persistence commonly established under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The RAT uses RC4-encrypted command-and-control (C2) communications and is built for resilience, with multiple independent C2 paths on separate infrastructure.

Other tools and components that have been reported to be used in Woodgnat attack chains include:

Once a command is executed, a multi-stage PowerShell chain downloads and unpacks a portable WinPython environment and launches the ModeloRAT Python scripts. The group then conducts extensive reconnaissance using built-in Windows tooling, enumerating domain users, groups, computers and sessions with net.exe, gathering host and service inventories with PowerShell, and performing Active Directory and Kerberoasting queries against accounts with service principal names to harvest crackable credentials.

Persistence is established through several redundant mechanisms, including Run-key entries that masquerade as legitimate remote-access software, using names such as AnyDesk, Splashtop and Comms; Startup-folder shortcuts; VBScript launchers, and scheduled tasks. Data is staged and exfiltrated over HTTP using curl.exe, and the group has been observed capturing screenshots and deploying a credential stealer.

A consistent feature of Woodgnat tradecraft is an emphasis on operational resilience and evasion. The ModeloRAT toolkit has been reported to use a pool of multiple C2 servers with sequential failover and several independent access paths on separate infrastructure, while non-domain-joined victims receive a more heavily obfuscated variant that uses a domain-generation algorithm to cycle through fresh C2 domains each week. Lure and loader stages routinely profile the victim host for analysis tools and virtual-machine indicators and distinguish domain-joined corporate machines from standalone WORKGROUP hosts so that the higher-value ModeloRAT payload is reserved for enterprise targets.

Woodgnat's targeting is largely opportunistic, reflecting its role as an initial access broker. It is unclear where Woodgnat is based. The group is assessed to be a financially motivated cybercrime operation rather than a state- actor, consistent with its initial-access-broker business model and its sale of access to ransomware affiliates.

The use of custom tools in ransomware attacks is becoming a more common phenomenon, with multiple examples of ransomware groups using custom exfiltration and other tools in recent times . Backdoor.Mistic appears to be a continuation of this trend, though it appears to be likely developed by access brokers working with ransomware affiliates rather than a ransomware group itself.

The stealth of the backdoor is also notable, as is the fact that Woodgnat is also possibly behind the development of ModeloRAT, indicating a group that is quite highly skilled at the development of stealthy remote access tools. This indicates it is a group that should be actively tracked as it could continue to develop custom tools, as well as widen the pool of ransomware actors it works with. The use of custom tools by ransomware actors is also a trend to watch, as up to recent times ransomware actors preferred the use of living-off-the-land and dual-use tools, so this increased use of custom tools might point to a change in their activity too.

For the latest protection updates, please visit the Symantec Protection Bulletin .

1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984 – Backdoor.Mistic - endpointdlp.dll 34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc - Fake lock screen - f.dll 3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be - Backdoor.Mistic - aeff97fe.msi 59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712 - Loader for backdoor - version.dll 8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235 - Likely privilege escalation - n.dll afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c - Backdoor.Mistic - endpointdlp.dll db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5 - Backdoor.Mistic - endpointdlp.dll f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e - Backdoor.Mistic - 48b47c0.msi fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a - Backdoor.Mistic - endpointdlp.dll

Network indicators 142.93.242.144 144.31.53.78 198.13.159.44 199.91.221.42 authorized-logins.net b6w9m2z5x8q1v3k.top carrolc.com cj06y9v4xab.com cwrtwright.com defs.updater-worelos.com ftps.upd-domain-goloro.com grande-luna.top hxxp://thomphon.com/update.msi human-check.top mail.authorized-logins.net mailes.upd-domain-goloro.com mails.updater-worelos.com mueleer.com nano.upscale-kolo.com oeannon.com php.authorized-logins.net rotoa-upda-lo.com sql-updater-service.com sss.authorized-logins.net thomphon.com upd-domain-goloro.com update.update-fall.com updater-worelos.com upscale-kolo.com w3xasv14culvnqj.top