ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker

The Python-based remote access trojan ModeloRAT and a newly observed stealth backdoor, dubbed Backdoor.Mistic, to activity consistent with an initial access broker (IAB) operation that facilitates ransomware deployments.

Mistic first seen in April 2026 and publicized by Zscaler as MLTBackdoor access appears optimized for long-term, low-visibility access and was discovered deployed in at least one intrusion alongside ModeloRAT, strengthening ties between these tools and financially motivated access-sellers tracked as Woodgnat (aka KongTuke).

Backdoor.Mistic demonstrates deliberate design choices for stealth and persistence. It is sideloaded through a legitimate executable, MpExtMs.exe, which loads a malicious DLL named EndpointDlp.dll an innocuous-sounding name that mimics Microsoft endpoint-security components.

A loader hooks GetModuleFileNameW and LoadLibraryW to ensure the legitimate binary path is used while forcing the process to load the malicious DLL .

The backdoor executes payloads directly in memory, leaving no files on disk, and includes a kill switch allowing the operator to self-delete features that prioritize long-term covert access and complicate forensic detection.

Functionally, Mistic supports standard backdoor tasks: file upload/download, file and folder manipulation, schedule and frequency adjustments for its command checks, and in-memory execution of C2-delivered code.

Targeting has been opportunistic; compromised organizations span insurance, education, IT and professional services, suggesting the operator’s objective is to establish saleable enterprise access rather than focus on a particular industry vertical.

ModeloRAT continues to be a hallmark of Woodgnat activity. Delivered commonly within a portable WinPython package and run via signed pythonw.exe, ModeloRAT uses RC4-encrypted C2 communications and multi-path resiliency with independent C2 infrastructure.

Symantec’s Threat Hunter Team observed ModeloRAT used in attacks that culminated in Qilin ransomware deployment, linking the RAT to final-stage ransomware activity.

Public reporting also attributes Woodgnat to facilitating access for multiple ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta.

The intrusion chain observed by Symantec combined multiple stages and tools: a .NET credential stealer with a fake login prompt, living-off-the-land utilities such as curl, reg.exe, net.exe, certutil, WMIC and PowerShell for reconnaissance, lateral movement and payload staging, and loaders like WinPython and Node.exe to host ModeloRAT and other scripts.

Zscaler additionally reported Mistic deliveries via Woodgnat-style social-engineering campaigns ClickFix , FileFix and CrashFix lures that trick victims into executing attacker-supplied PowerShell commands.

More recently, Woodgnat has used Microsoft Teams helpdesk pretexts to coerce victims into “paste-and-run” commands, achieving persistent access within minutes.

Operational tradecraft shows emphasis on evasion: signed carriers, in-memory execution, kill switches, credential theft, extensive host profiling, redundant persistence entries masquerading as legitimate remote-access software, and adaptive C2 mechanisms including domain generation for non-domain hosts.

This combination of capabilities and behavior is consistent with an IAB model that prioritizes durable, stealthy enterprise footholds to monetize access to ransomware affiliates.

For defenders, indicators of compromise to prioritize include unexpected loading of EndpointDlp.dll or similarly named DLLs by MpExtMs.exe, anomalous in-memory execution activities, Run-key persistence entries named after remote-support tools, and evidence of WinPython or signed pythonw.exe running unknown scripts.

Tracking Woodgnat-linked infrastructure and the evolution of ModeloRAT and Mistic will be critical as this access-broker model continues to fuel ransomware operations.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

Android Malware Campaign Uses Fake Document Reader App with 100K Google Play Downloads tracks a…

Grafana Labs has confirmed that a recent supply chain attack involving the TanStack npm ecosystem…

An active phishing campaign that impersonates Microsoft Teams to trick victims into downloading a legitimately…

A concerted campaign by an initial access broker with ties to the Payouts King ransomware…

A proof-of-concept exploit has been released for CVE-2026-45502, a server-side request forgery (SSRF) vulnerability in…

A newly disclosed stored cross-site scripting (XSS) vulnerability in Webmin has raised significant security concerns,…