Related Threat Clusters

New Mistic Backdoor Linked to Ransomware Access Broker Activity
A new backdoor known as Mistic has been identified in cyberattacks targeting various sectors since April 2026. It is associated with the initial access broker KongTuke, also known as Woodgnat, which sells access to…

21 articles · Updated June 24, 2026
Mistic Malware Targets Microsoft Endpoint with Stealthy DLL Sideloading Technique
The Mistic malware, a newly identified Windows backdoor, has been active since April 2026, utilizing DLL sideloading to infiltrate enterprise environments. It exploits a legitimate executable, MpExtMs.exe, to load a…

2 articles · Updated June 30, 2026
CrashFix Campaign Delivers ModeloRAT via Malicious Chrome Extension
A malicious campaign named CrashFix has been identified, utilizing a fake ad-blocking browser extension called NexShield to crash users' browsers. This tactic is employed to facilitate ClickFix attacks, delivering a new…

3 articles · Updated January 20, 2026
NexShield Malware Extension Crashes PCs to Install Malware
Security researchers have identified a malicious browser extension named NexShield that masquerades as an ad blocker for Chrome and Edge. Upon installation, it intentionally crashes the browser, misleading users into…

1 article · Updated February 16, 2026

Recent Intelligence Reports

Mistic Malware Blends Into Microsoft Endpoint Components Using Malicious EndpointDlp.dll — Gbhackers · June 30, 2026
Stealthy Mistic Backdoor Targets Enterprise Networks via KongTuke Ransomware Access Broker — Rescana · June 25, 2026
ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker — Gbhackers · June 24, 2026
Stealthy Mistic backdoor linked to ransomware access broker KongTuke — Bleepingcomputer · June 24, 2026
Fake ad blocker breaks PCs in new malware extension scam — Foxnews · February 16, 2026
CrashFix attack hijacks browser failures to deliver ModelRAT malware via fake Chrome extension — Csoonline · January 20, 2026
Fake ad blocker extension crashes the browser for ClickFix attacks — Bleepingcomputer · January 19, 2026

KongTuke Woodgnat Data Breach DDoS Malware Phishing Ransomware Supply Chain Attack Contagious Interview Operation FileFix Education CVE-2026-33017