New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

1. Executive summary

A new stealthy backdoor dubbed Mistic (also tracked as MLTBackdoor) has been deployed in financially motivated attacks against organisations in the insurance, education, IT, and professional services sectors since April 2026. The backdoor is attributed by Symantec/Carbon Black to the initial access broker (IAB) KongTuke (aka 404 TDS, Chaya_002, LandUpdate808, TAG-124, Woodgnat) — an attribution that is unconfirmed because KongTuke has no MITRE ATT&CK profile in the verified reference data. Mistic operates fully in-memory, uses DLL side-loading via a trusted Microsoft executable (MpExtMs.exe), and is delivered through ClickFix social-engineering campaigns. KongTuke has been observed deploying ModeloRAT (a Python RAT) in attacks that subsequently deployed Qilin ransomware, making this directly relevant to EMEA financial services organisations that may be targeted as access-for-sale victims.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access — ClickFix social engineering. KongTuke actors use ClickFix lures to trick victims into executing arbitrary commands. Two delivery variants have been observed: - CrashFix variant: A malicious Google Chrome extension masquerading as an ad blocker intentionally crashes the victim's browser, then prompts the user to run a command under the pretext of a security scan. First flagged by Huntress in January 2026 in connection with ModeloRAT. - DNS-staging variant: Commands perform a DNS lookup to retrieve the next-stage payload. Microsoft noted that the attack chain uses DNS as a "lightweight staging or signaling channel."
2. Alternative initial access — Microsoft Teams social engineering. Rapid7 and ReliaQuest reported that KongTuke pivoted to sending Microsoft Teams messages from a fake IT Support account to trigger an attack chain leading to ModeloRAT deployment.
3. Payload delivery — Mistic backdoor. Mistic is deployed alongside or following ModeloRAT (a Python RAT previously attributed to the group). Zscaler ThreatLabz attributed Mistic's use of ClickFix as a delivery vector to a ransomware-related threat actor.
4. Execution — DLL side-loading. Mistic uses DLL side-loading via MpExtMs.exe, a trusted Microsoft endpoint security tooling executable, to blend in and evade detection.
5. In-memory operation. The backdoor runs payloads entirely in memory with no files written to disk. It can execute code received from C2 in memory without leaving artifacts.
6. C2 polling. Mistic polls a remote server for commands at a configurable time interval, which it can modify dynamically.

Mistic backdoor capabilities

• Upload or download a file
• Move, rename, or delete a file
• Create a folder
• Modify the polling interval for C2 command retrieval
• Execute code received from C2 in memory (no disk artifacts)
• Load Beacon Object Files (BOFs) to dynamically expand capabilities
• Terminate and delete itself (kill switch)

Persistence and stealth

• No file written to disk during payload execution
• Kill switch enables self-deletion
• DLL side-loading via MpExtMs.exe (trusted Microsoft binary) to avoid raising suspicion
• Long-term, low-visibility access is the operator's objective per Broadcom

Observed impact and downstream activity

• Targeting is opportunistic — attackers cast a wide net across insurance, education, IT, and professional services, then assess which organisations they can sell access to.
• ModeloRAT has been observed in attacks that deployed Qilin ransomware.
• KongTuke operates a traffic distribution system (TDS) built on compromised WordPress sites, serving evolving lures.
• Broadcom assesses Mistic as "likely developed by access brokers working with ransomware affiliates rather than a ransomware group itself."

Attribution caveat

Single-sourced; verify before enforcement. The KongTuke attribution rests on Symantec/Carbon Black (Broadcom) reporting. KongTuke has no MITRE ATT&CK profile in the verified reference data — attribution is unconfirmed. The aliases 404 TDS, Chaya_002, LandUpdate808, TAG-124, and Woodgnat are sourced from the same Broadcom report. The connection to Qilin ransomware is reported by BleepingComputer and The Hacker News citing Broadcom; this is a single-vendor-sourced claim.

4. Mitigation & containment

P1 — Within 24 hours

• Hunt for MpExtMs.exe DLL side-loading. Search endpoint telemetry for MpExtMs.exe executing from non-standard paths or loading unsigned/unusual DLLs. Legitimate Microsoft endpoint tooling runs from expected install directories — flag any instance loading DLLs from temp, user-profile, or world-writable paths.
• Block anomalous DNS traffic patterns. Mistic's DNS-staging variant uses DNS as a signaling channel. Correlate high-volume or unusual DNS TXT queries from workstations with subsequent process execution events.
• Quarantine any host with suspected Mistic or ModeloRAT. Given in-memory execution, standard file-based quarantine will not suffice — isolate the host at the network level and capture a full memory image for forensic analysis before reimaging.
• Alert on BOF loading. If Cobalt Strike or other BOF-capable frameworks are not part of the standard build, any process loading BOFs is high-confidence malicious.

P2 — Within 72 hours

• Review Chrome extension policy. Enforce extension blocklists or allowlists via Group Policy / MDM to prevent unvetted extensions (the CrashFix vector uses a malicious ad-blocker extension). Block extension installation from outside the enterprise store.
• Harden Microsoft Teams. Restrict external Teams communication. Alert on messages from accounts not in the corporate directory, especially those claiming IT Support roles.
• Audit WordPress infrastructure. If the organisation operates WordPress sites, audit for compromise — KongTuke's TDS is built on compromised WordPress installations.
• Deploy EDR in-memory detection rules. Configure EDR to alert on processes executing injected code without a corresponding on-disk binary, particularly those exhibiting C2 polling behaviour (periodic outbound connections to the same destination at regular intervals).

P3 — Within 7 days

• Conduct a tabletop exercise using the Mistic attack chain (ClickFix → DNS staging → in-memory backdoor → BOF loading → lateral movement → ransomware) to test detection coverage at each stage. This aligns with DORA Art. 24 (digital operational resilience testing — general requirements).
• Review third-party provider exposure. Assess whether any ICT third-party providers in the supply chain use WordPress or are exposed to the TDS infrastructure. Aligns with DORA Art. 28 and Art. 29.
• Update threat-intelligence feed subscriptions to include Broadcom/Symantec, Huntress, Zscaler ThreatLabz, Rapid7, and ReliaQuest reporting on KongTuke/ModeloRAT/Mistic.

5. Indicators of compromise

filename  MpExtMs.exe
malware_name  Mistic
malware_name  MLTBackdoor
malware_name  ModeloRAT
actor_alias  KongTuke
actor_alias  404 TDS
actor_alias  Chaya_002
actor_alias  LandUpdate808
actor_alias  TAG-124
actor_alias  Woodgnat
ransomware  Qilin
campaign  ClickFix
campaign  CrashFix

6. Detection

YARA rule

rule Backdoor_Mistic_KongTuke {
    meta {
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html"
        description = "Detects Mistic backdoor artefacts associated with KongTuke/ClickFix campaigns. Strings derived from source reporting; no hashes available in source material."
    }

    strings:
        $exe_name = "MpExtMs.exe" ascii nocase
        $malware_mistic = "Mistic" ascii nocase
        $malware_mlt = "MLTBackdoor" ascii nocase
        $campaign_clickfix = "ClickFix" ascii nocase
        $campaign_crashfix = "CrashFix" ascii nocase
        $modelorat = "ModeloRAT" ascii nocase
        $actor_kongtuke = "KongTuke" ascii nocase
        $actor_404tds = "404 TDS" ascii nocase
        $actor_chaya = "Chaya_002" ascii nocase
        $actor_landupdate = "LandUpdate808" ascii nocase
        $actor_tag124 = "TAG-124" ascii nocase
        $actor_woodgnat = "Woodgnat" ascii nocase

    condition:
        2 of them
}

Sigma rule

title: Suspicious Execution of MpExtMs.exe from Non-Standard Path
id: 7a3c1e2f-9b4d-4f8a-a6e1-0d5c2b7e8f1a
status: experimental
description: >
  Detects MpExtMs.exe executing from a non-standard directory, consistent with
  DLL side-loading as used by the Mistic backdoor (KongTuke/ClickFix campaign).
  Legitimate Microsoft endpoint security tooling runs from expected install paths.
references:

  - https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html
  - https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/
author: Adverse Trace
date: 2026/06/25
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\MpExtMs.exe'
    filter_legitimate_paths:
        Image|startswith:

            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not filter_legitimate_paths
falsepositives:

    - Legitimate Microsoft endpoint tooling installed in a custom directory (verify with vendor)
level: high

title: ModeloRAT or Mistic-Related Process Execution via ClickFix Social Engineering
id: 8b4d2f3a-0c5e-4f9b-b7f2-1e6d3c8a9d2b
status: experimental
description: >
  Detects execution of Python-based ModeloRAT or suspicious command-line activity
  consistent with ClickFix/CrashFix delivery vectors used by KongTuke.
references:

  - https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html
author: Adverse Trace
date: 2026/06/25
logsource:
    product: windows
    category: process_creation
detection:
    selection_python:
        Image|endswith: '\python.exe'
        CommandLine|contains:

            - 'ModeloRAT'
    selection_dns_staging:
        CommandLine|contains:

            - 'nslookup'
            - 'Resolve-DnsName'
        CommandLine|contains:

            - 'http'
            - 'download'
            - 'Invoke-'
    condition: selection_python or selection_dns_staging
falsepositives:

    - Legitimate DNS lookup activity by administrators (correlate with subsequent suspicious process creation)
level: medium

7. Sources

• The Hacker News — "New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns" — https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html — 2026-06-25
• BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke" — https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/ — 2026-06-25

8. Adverse Trace position

Severity assessment: is appropriate. Mistic is a capable, stealthy backdoor with in-memory execution, BOF loading, and a kill switch — but it is not a zero-day being mass-expploited in the wild against a specific patched/unpatched software boundary. The threat is real and active since April 2026 but requires social-engineering as the initial vector, which is defensible with user awareness and endpoint controls. No CISA-KEV entry or CVSS score exists for this malware family in the verified reference data — this is a threat-actor/tooling advisory, not a CVE-driven one. Client-impact assessment: EMEA financial services organisations — particularly those in insurance — should treat this as a ransomware-precursor threat. The KongTuke → ModeloRAT → Qilin chain has been reported, though the ransomware connection is single-sourced via Broadcom and should be verified before enforcement. The KongTuke attribution is unconfirmed (no MITRE ATT&CK profile). Next steps: Adverse Trace will monitor for additional corroboration of the KongTuke attribution and Qilin connection from independent sources, track any new Mistic or ModeloRAT variants, and update IOCs as hashes, domains, or IP addresses become available. Clients should prioritise P1 containment actions and review their Chrome extension and Teams external-messaging policies.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.