ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker

Gbhackers •Mayura Kathir • June 24, 2026

The Python-based remote access trojan ModeloRAT and a newly observed stealth backdoor, dubbed Backdoor.Mistic, to activity consistent with an initial access broker (IAB) operation that facilitates ransomware deployments. Mistic first seen in April 2026 and publicized by Zscaler as MLTBackdoor access appears optimized for long-term, low-visibility access and was discovered deployed in at least one […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Mistic Backdoor Linked to Ransomware Access Broker Activity A new backdoor known as Mistic has been identified in cyberattacks targeting various sectors since April 2026. It is associated with the initial access broker KongTuke, also known as Woodgnat, which sells access to ransomware groups like Qilin and Interlock. Mistic is delivered through DLL sideloading, using a legitimate Microsoft Defender executable (MpExtMs.exe) to load a malicious DLL (EndpointDlp.dll) directly into memory, avoiding detection. This backdoor supports standard functionalities like file manipulation and remote payload execution without leaving traces on disk. The attacks have affected organizations in insurance, education, IT, and professional services. Symantec's Threat Hunter Team has observed Mistic's deployment alongside ModeloRAT, enhancing the stealth and persistence of these operations. The malware's design emphasizes long-term access, with features like a kill switch for self-deletion. 14 sources 70

Extracted Entities

ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker

The full story

Extracted Entities

Attack Types (1)

Malware (3)

Tools (1)