> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs - URL: https://f4n6.co.uk/security-feed/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/ - Published: 2026-06-26T10:08:45.000Z - Updated: 2026-06-26T10:08:45.000Z - Author: Jeff Davies - Tags: #security-feed, KongTuke, Woodgnat, qilin, Interlock, Rhysida ## 1\. Executive summary A new backdoor tracked as **Mistic** (also tracked as **MLTBackdoor**) has been deployed in financially motivated intrusions since April 2026, targeting organisations across insurance, education, IT, and professional services sectors. Symantec and Carbon Black Threat Hunter Team assess with **low confidence** that Mistic is linked to the initial access broker (IAB) tracked publicly as **KongTuke** (which Symantec tracks as **Woodgnat**) — an actor that sells network footholds to ransomware crews including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Mistic is a stealthy backdoor with in-memory execution, file management, and self-destruct capabilities, delivered via a multi-stage **ClickFix** infection chain. EMEA financial services — particularly insurance sub-sectors — should treat this as an active initial-access threat that may precede ransomware deployment. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Mistic backdoor establishes persistent C2 access to corporate networks, constituting an ICT-related incident requiring detection, containment, and response processes. | Financial institutions must have processes to detect, triage, and respond to backdoor intrusions like Mistic; ensure incident playbooks cover IAB-delivered footholds. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Mistic represents a novel backdoor threat linked to IAB-to-ransomware supply chain; classification must reflect severity and potential for ransomware follow-on. | Classify Mistic detections as high-severity given IAB linkage and ransomware precursor pattern; factor in the self-destruct evasion capability when assessing scope. | | NIS2 Art. 21(2)(d): supply chain security measures | The IAB model (KongTuke/Woodgnat) represents a criminal supply chain where initial access is sold to ransomware operators; organisations' own supply chain security posture affects susceptibility to the ClickFix initial access vector. | Assess supply chain exposure to ClickFix-style social engineering vectors; ensure third-party and supplier environments are not compromised in ways that facilitate Mistic delivery. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | Mistic backdoor provides persistent C2 access to organisational networks, potentially impacting operational resilience of systems and services. | OES and RDSP operators should ensure monitoring covers DLL side-loading and in-memory execution patterns consistent with Mistic; incident response procedures must address self-destructing malware. | ## 3\. Technical analysis & attack chain ### Confirmed attack chain 1. **Initial access via ClickFix.** Mistic is delivered through a multi-stage **ClickFix** infection chain. ClickFix is a social-engineering technique associated with KongTuke/Woodgnat. Zscaler first reported this delivery vector for Mistic. This is corroborated by Symantec/Carbon Black and The Hacker News. 2. **DLL side-loading.** In at least one incident responded to by Symantec and Carbon Black, Mistic was side-loaded through a legitimate file named **`MpExtMs.exe`**. The malicious payload was loaded from a DLL named **`EndpointDlp.dll`**, which likely helped the backdoor blend in with legitimate software (the naming convention mimics Microsoft Defender and Endpoint DLP components). 3. **Backdoor execution.** Mistic establishes communication with an attacker-controlled C2 server and operates with the following capabilities: - **File operations:** upload, download, move, rename, and delete files; create new folders. - **Command retrieval:** checks for additional commands from the C2 server. - **In-memory payload execution:** runs remote payloads from C2 directly in memory, avoiding writes to disk and evading file-based detection in AV and EDR products. - **Self-destruct:** terminates and deletes itself when the mission is accomplished, leaving minimal forensic footprint. 4. **Potential follow-on: ModeloRAT.** In at least one intrusion, Mistic was deployed in close proximity to **ModeloRAT**, a Python-based remote access trojan associated with KongTuke/Woodgnat. Symantec and Carbon Black separately observed ModeloRAT used in attacks that deployed **Qilin ransomware**. ### Attribution assessment - **KongTuke / Woodgnat:** Symantec and Carbon Black assess the link between Mistic and KongTuke/Woodgnat as **low confidence**. The assessment is based on: (a) co-deployment of Mistic and ModeloRAT in a single intrusion; (b) KongTuke's known use of the ClickFix technique; (c) KongTuke's known development of ModeloRAT. **Attribution is unconfirmed.** Per verified reference data, KongTuke has **no MITRE ATT&CK profile** and Woodgnat has **no MITRE ATT&CK profile** — treat both attributions as unconfirmed. - **KongTuke ransomware crew associations:** KongTuke has been linked to attacks involving Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Of these, only **Akira** has a confirmed MITRE ATT&CT profile (MITRE G1024). The remaining actors — Qilin, Interlock, Rhysida, 8Base, and Black Basta — have **no MITRE ATT&CK profiles**; their involvement is reported by Symantec/Carbon Black but should be treated as unconfirmed attribution. - **Single-sourced confidence caveat:** The Mistic–KongTuke/Woodgnat linkage and the ModeloRAT co-deployment detail are **single-sourced** to Symantec and Carbon Black Threat Hunter Team. Zscaler independently documented Mistic (as MLTBackdoor) and the ClickFix delivery chain, but the specific KongTuke attribution and ModeloRAT proximity finding come from Symantec/Carbon Black only. **Verify before enforcement.** ### Affected sectors Insurance, education, IT, and professional services. The insurance sector overlap is directly relevant to EMEA financial services clients. ### No CVE data No specific CVE, exploited product vulnerability, or patch is identified in the source material. The initial access vector is social-engineering-based (ClickFix) rather than exploitation of a specific software vulnerability. No CISA-KEV entry applies. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Hunt for DLL side-loading artefacts.** Search endpoint telemetry and file systems for: - `MpExtMs.exe` in non-standard locations (not within legitimate Microsoft Defender installation paths). - `EndpointDlp.dll` loaded by processes other than legitimate Microsoft Defender/Endpoint DLP components. - Command: `Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=7} | Where-Object {$_.Message -match 'EndpointDlp.dll'}` (if Sysmon Event ID 7 — Image Loaded — is instrumented). - **Block known ClickFix indicators.** If your organisation has identified ClickFix-related infrastructure or domains from previous incidents, ensure web proxy, DNS filtering, and email gateway rules are enforced. ClickFix is a social-engineering vector — reinforce user awareness messaging around fake verification/CAPTCHA prompts. - **Alert on in-memory execution patterns.** Configure EDR to alert on processes injecting or executing payloads directly in memory without corresponding on-disk artefacts, particularly from processes spawned by or loading `MpExtMs.exe`. ### P2 — Within 72 hours - **Audit for ModeloRAT.** Search for Python-based remote access trojan artefacts associated with KongTuke/Woodgnat. Look for unusual Python processes (`python.exe`, `pythonw.exe`) executing from temp directories, user-profile AppData paths, or non-standard locations, particularly those establishing outbound network connections. - **Review C2 communications.** Correlate network logs for outbound connections from processes loading `EndpointDlp.dll`. Mistic checks for commands from C2 — look for periodic beaconing patterns from side-loaded processes. - **Enhance DLL side-loading detection.** Deploy or tune Sysmon/EDR rules to flag DLLs loaded from the same directory as the loading executable (DLL side-loading pattern), especially for executables with names mimicking Microsoft security products. ### P3 — Within 7 days - **Tabletop exercise.** Run a DORA Art. 24-aligned tabletop exercise covering the IAB-to-ransomware attack chain: initial access via ClickFix → Mistic backdoor deployment → C2 establishment → potential ModeloRAT deployment → ransomware execution. Validate detection at each stage and identify gaps. - **Threat hunt across insurance subsidiary estate.** If your organisation has insurance arms or subsidiaries, prioritise threat hunting in those environments given the confirmed targeting of the insurance sector. - **Review self-destruct evasion coverage.** Ensure endpoint forensic tooling can recover evidence of self-destructing malware (e.g., prefetch data, registry traces, event log entries for process creation/termination, USRJV journal data). Mistic's self-destruct capability means traditional file-based forensics may yield limited results. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------------- | -------------------------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | filename | MpExtMs.exe | High (observed in incident response) | The Register / Symantec-Carbon Black | | filename | EndpointDlp.dll | High (observed in incident response) | The Register / Symantec-Carbon Black | | malware\_name | Mistic | High (multi-source corroborated) | The Register / Zscaler / Symantec-Carbon Black / Help Net Security / BleepingComputer / SecurityWeek | | malware\_name | MLTBackdoor | High (Zscaler tracking name) | The Register / Zscaler | | malware\_name | ModeloRAT | Medium (associated, not Mistic itself) | The Register / Symantec-Carbon Black | | actor\_name | KongTuke | Low confidence (unconfirmed attribution) | The Register / Symantec-Carbon Black | | actor\_name | Woodgnat | Low confidence (unconfirmed attribution; Symantec's tracking name for KongTuke) | The Register / Symantec-Carbon Black / Help Net Security | | technique | ClickFix (multi-stage infection chain) | Medium (Zscaler + Symantec corroboration) | The Register / Zscaler / Symantec-Carbon Black | ```iocs filename MpExtMs.exe filename EndpointDlp.dll malware_name Mistic malware_name MLTBackdoor malware_name ModeloRAT actor_name KongTuke actor_name Woodgnat technique ClickFix ``` ## 6\. Detection ### YARA rule ```yara rule Mistic_Backdoor_DLL_Sideload { meta { author = "Adverse Trace" date = "2026-06-26" reference = "https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579" description = "Detects Mistic backdoor side-loading artefacts via MpExtMs.exe and EndpointDlp.dll" severity = "high" } strings: $dll_name = "EndpointDlp.dll" ascii nocase $exe_name = "MpExtMs.exe" ascii nocase $mistic_ref = "Mistic" ascii nocase $mlt_ref = "MLTBackdoor" ascii nocase condition: 2 of them } ``` ### Sigma rule ```yaml title: Mistic Backdoor DLL Side-Loading via MpExtMs.exe id: AT-2026-06-26-182-sigma-1 status: experimental description: Detects potential Mistic backdoor side-loading where EndpointDlp.dll is loaded by MpExtMs.exe outside legitimate Microsoft Defender paths references: - https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579 author: Adverse Trace date: 2026/06/26 logsource: product: windows category: image_load detection: selection_image: Image|endswith: '\MpExtMs.exe' selection_dll: ImageLoaded|endswith: '\EndpointDlp.dll' filter_legitimate: ImageLoaded|startswith: - 'C:\Program Files\Windows Defender\' - 'C:\ProgramData\Microsoft\Windows Defender\' - 'C:\Program Files\Microsoft\Endpoint Manager\' condition: selection_image and selection_dll and not filter_legitimate falsepositives: - Legitimate Microsoft Defender or Endpoint DLP components loading from standard installation paths level: high ``` ```yaml title: Mistic Backdoor C2 Check from Side-Loaded Process id: AT-2026-06-26-182-sigma-2 status: experimental description: Detects network connections from MpExtMs.exe, consistent with Mistic backdoor C2 communication references: - https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579 author: Adverse Trace date: 2026/06/26 logsource: product: windows category: network_connection detection: selection: Image|endswith: '\MpExtMs.exe' filter_legitimate: Image|startswith: - 'C:\Program Files\Windows Defender\' - 'C:\ProgramData\Microsoft\Windows Defender\' condition: selection and not filter_legitimate falsepositives: - Legitimate Microsoft Defender network telemetry from standard installation paths level: medium ``` ## Threat actor context **Akira** · [G1024](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius [Akira](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) is a ransomware variant and ransomware deployment entity active since at least March 2023\. [Akira](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. … *No MITRE ATT&CK profile for: KongTuke, Woodgnat, Qilin, Interlock, Rhysida, 8Base, Black Basta.* ## 7\. Sources - The Register — "Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs" — https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579 — 2026-06-25 - Help Net Security — "Stealthy new backdoor emerges in attacks on multiple sectors" — https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/ — 2026-06-25 - The Hacker News — "New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns" — https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html — 2026-06-25 - BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke" — https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/ — 2026-06-25 - SecurityWeek — "New 'Mistic' RAT Opens Door to Several Ransomware Families" — https://www.securityweek.com/new-mistic-rat-opens-door-to-several-ransomware-families/ — 2026-06-25 ## 8\. Adverse Trace position **Severity assessment:** . Mistic is a capable, stealthy backdoor with in-memory execution and self-destruct capabilities that complicate detection and forensic recovery. No CVE or patch is available — the initial access vector is social-engineering-based (ClickFix), meaning patching alone cannot mitigate the threat. The IAB-to-ransomware attack chain represents a credible threat to EMEA financial services, particularly insurance sub-sectors that match the observed targeting profile. **Attribution confidence:** Low. The KongTuke/Woodgnat linkage is single-sourced to Symantec/Carbon Black and explicitly described as low confidence by the researchers themselves. KongTuke and Woodgnat have no MITRE ATT&CK profiles — attribution is unconfirmed. Of the named ransomware crews associated with KongTuke, only Akira (MITRE G1024) has a confirmed MITRE profile; Qilin, Interlock, Rhysida, 8Base, and Black Basta have no MITRE profiles and their involvement should be treated as unconfirmed. **Client-impact assessment:** EMEA financial services clients with insurance operations are in the observed targeting profile. The ClickFix social-engineering vector and DLL side-loading technique are not sector-specific — any organisation with insufficient endpoint monitoring for side-loading and in-memory execution is potentially exposed. The self-destruct capability means that organisations relying primarily on file-based detection may miss Mistic entirely. **Next steps:** Adverse Trace will continue monitoring for additional Mistic IOCs, C2 infrastructure, and ModeloRAT samples. We will update this advisory if attribution strengthens or if C2 domains/IPs emerge. Clients should deploy the YARA and Sigma rules provided in §6 and prioritise threat hunting in insurance-sector environments. --- [Read the original source →](https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*