Back Feeds.4Sysops

New Mistic backdoor enables stealthy long term access for ransomware brokers

Feeds.4Sysops •IT News • June 24, 2026

A new backdoor named Mistic has emerged in cybercrime campaigns targeting the insurance, education, and IT sectors since April 2026. Security researchers link this malware to the initial access broker KongTuke, also known as Woodgnat, who sells network access to major ransomware groups. The backdoor is frequently deployed alongside ModeloRAT and is often delivered through social engineering tactics or multi-stage infection chains. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Mistic Backdoor Linked to Ransomware Access Broker Activity A new backdoor known as Mistic has been identified in cyberattacks targeting various sectors since April 2026. It is associated with the initial access broker KongTuke, also known as Woodgnat, which sells access to ransomware groups like Qilin and Interlock. Mistic is delivered through DLL sideloading, using a legitimate Microsoft Defender executable (MpExtMs.exe) to load a malicious DLL (EndpointDlp.dll) directly into memory, avoiding detection. This backdoor supports standard functionalities like file manipulation and remote payload execution without leaving traces on disk. The attacks have affected organizations in insurance, education, IT, and professional services. Symantec's Threat Hunter Team has observed Mistic's deployment alongside ModeloRAT, enhancing the stealth and persistence of these operations. The malware's design emphasizes long-term access, with features like a kill switch for self-deletion. 21 sources 70

Extracted Entities

New Mistic backdoor enables stealthy long term access for ransomware brokers

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (2)

MITRE ATT&CK (1)