Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs

1. Executive summary

A new backdoor tracked as Mistic (also tracked as MLTBackdoor) has been deployed in financially motivated intrusions since April 2026, targeting organisations across insurance, education, IT, and professional services sectors. Symantec and Carbon Black Threat Hunter Team assess with low confidence that Mistic is linked to the initial access broker (IAB) tracked publicly as KongTuke (which Symantec tracks as Woodgnat) — an actor that sells network footholds to ransomware crews including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Mistic is a stealthy backdoor with in-memory execution, file management, and self-destruct capabilities, delivered via a multi-stage ClickFix infection chain. EMEA financial services — particularly insurance sub-sectors — should treat this as an active initial-access threat that may precede ransomware deployment.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access via ClickFix. Mistic is delivered through a multi-stage ClickFix infection chain. ClickFix is a social-engineering technique associated with KongTuke/Woodgnat. Zscaler first reported this delivery vector for Mistic. This is corroborated by Symantec/Carbon Black and The Hacker News.
2. DLL side-loading. In at least one incident responded to by Symantec and Carbon Black, Mistic was side-loaded through a legitimate file named MpExtMs.exe. The malicious payload was loaded from a DLL named EndpointDlp.dll, which likely helped the backdoor blend in with legitimate software (the naming convention mimics Microsoft Defender and Endpoint DLP components).
3. Backdoor execution. Mistic establishes communication with an attacker-controlled C2 server and operates with the following capabilities: - File operations: upload, download, move, rename, and delete files; create new folders. - Command retrieval: checks for additional commands from the C2 server. - In-memory payload execution: runs remote payloads from C2 directly in memory, avoiding writes to disk and evading file-based detection in AV and EDR products. - Self-destruct: terminates and deletes itself when the mission is accomplished, leaving minimal forensic footprint.
4. Potential follow-on: ModeloRAT. In at least one intrusion, Mistic was deployed in close proximity to ModeloRAT, a Python-based remote access trojan associated with KongTuke/Woodgnat. Symantec and Carbon Black separately observed ModeloRAT used in attacks that deployed Qilin ransomware.

Attribution assessment

• KongTuke / Woodgnat: Symantec and Carbon Black assess the link between Mistic and KongTuke/Woodgnat as low confidence. The assessment is based on: (a) co-deployment of Mistic and ModeloRAT in a single intrusion; (b) KongTuke's known use of the ClickFix technique; (c) KongTuke's known development of ModeloRAT. Attribution is unconfirmed. Per verified reference data, KongTuke has no MITRE ATT&CK profile and Woodgnat has no MITRE ATT&CK profile — treat both attributions as unconfirmed.
• KongTuke ransomware crew associations: KongTuke has been linked to attacks involving Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Of these, only Akira has a confirmed MITRE ATT&CT profile (MITRE G1024). The remaining actors — Qilin, Interlock, Rhysida, 8Base, and Black Basta — have no MITRE ATT&CK profiles; their involvement is reported by Symantec/Carbon Black but should be treated as unconfirmed attribution.
• Single-sourced confidence caveat: The Mistic–KongTuke/Woodgnat linkage and the ModeloRAT co-deployment detail are single-sourced to Symantec and Carbon Black Threat Hunter Team. Zscaler independently documented Mistic (as MLTBackdoor) and the ClickFix delivery chain, but the specific KongTuke attribution and ModeloRAT proximity finding come from Symantec/Carbon Black only. Verify before enforcement.

Affected sectors

Insurance, education, IT, and professional services. The insurance sector overlap is directly relevant to EMEA financial services clients.

No CVE data

No specific CVE, exploited product vulnerability, or patch is identified in the source material. The initial access vector is social-engineering-based (ClickFix) rather than exploitation of a specific software vulnerability. No CISA-KEV entry applies.

4. Mitigation & containment

P1 — Within 24 hours

• Hunt for DLL side-loading artefacts. Search endpoint telemetry and file systems for:
• MpExtMs.exe in non-standard locations (not within legitimate Microsoft Defender installation paths).
• EndpointDlp.dll loaded by processes other than legitimate Microsoft Defender/Endpoint DLP components.
• Command: Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=7} | Where-Object {$_.Message -match 'EndpointDlp.dll'} (if Sysmon Event ID 7 — Image Loaded — is instrumented).
• Block known ClickFix indicators. If your organisation has identified ClickFix-related infrastructure or domains from previous incidents, ensure web proxy, DNS filtering, and email gateway rules are enforced. ClickFix is a social-engineering vector — reinforce user awareness messaging around fake verification/CAPTCHA prompts.
• Alert on in-memory execution patterns. Configure EDR to alert on processes injecting or executing payloads directly in memory without corresponding on-disk artefacts, particularly from processes spawned by or loading MpExtMs.exe.

P2 — Within 72 hours

• Audit for ModeloRAT. Search for Python-based remote access trojan artefacts associated with KongTuke/Woodgnat. Look for unusual Python processes (python.exe, pythonw.exe) executing from temp directories, user-profile AppData paths, or non-standard locations, particularly those establishing outbound network connections.
• Review C2 communications. Correlate network logs for outbound connections from processes loading EndpointDlp.dll. Mistic checks for commands from C2 — look for periodic beaconing patterns from side-loaded processes.
• Enhance DLL side-loading detection. Deploy or tune Sysmon/EDR rules to flag DLLs loaded from the same directory as the loading executable (DLL side-loading pattern), especially for executables with names mimicking Microsoft security products.

P3 — Within 7 days

• Tabletop exercise. Run a DORA Art. 24-aligned tabletop exercise covering the IAB-to-ransomware attack chain: initial access via ClickFix → Mistic backdoor deployment → C2 establishment → potential ModeloRAT deployment → ransomware execution. Validate detection at each stage and identify gaps.
• Threat hunt across insurance subsidiary estate. If your organisation has insurance arms or subsidiaries, prioritise threat hunting in those environments given the confirmed targeting of the insurance sector.
• Review self-destruct evasion coverage. Ensure endpoint forensic tooling can recover evidence of self-destructing malware (e.g., prefetch data, registry traces, event log entries for process creation/termination, USRJV journal data). Mistic's self-destruct capability means traditional file-based forensics may yield limited results.

5. Indicators of compromise

filename  MpExtMs.exe
filename  EndpointDlp.dll
malware_name  Mistic
malware_name  MLTBackdoor
malware_name  ModeloRAT
actor_name  KongTuke
actor_name  Woodgnat
technique  ClickFix

6. Detection

YARA rule

rule Mistic_Backdoor_DLL_Sideload {
    meta {
        author = "Adverse Trace"
        date = "2026-06-26"
        reference = "https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579"
        description = "Detects Mistic backdoor side-loading artefacts via MpExtMs.exe and EndpointDlp.dll"
        severity = "high"
    }
    strings:
        $dll_name = "EndpointDlp.dll" ascii nocase
        $exe_name = "MpExtMs.exe" ascii nocase
        $mistic_ref = "Mistic" ascii nocase
        $mlt_ref = "MLTBackdoor" ascii nocase
    condition:
        2 of them
}

Sigma rule

title: Mistic Backdoor DLL Side-Loading via MpExtMs.exe
id: AT-2026-06-26-182-sigma-1
status: experimental
description: Detects potential Mistic backdoor side-loading where EndpointDlp.dll is loaded by MpExtMs.exe outside legitimate Microsoft Defender paths
references:

  - https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579
author: Adverse Trace
date: 2026/06/26
logsource:
    product: windows
    category: image_load
detection:
    selection_image:
        Image|endswith: '\MpExtMs.exe'
    selection_dll:
        ImageLoaded|endswith: '\EndpointDlp.dll'
    filter_legitimate:
        ImageLoaded|startswith:

            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\'
            - 'C:\Program Files\Microsoft\Endpoint Manager\'
    condition: selection_image and selection_dll and not filter_legitimate
falsepositives:

    - Legitimate Microsoft Defender or Endpoint DLP components loading from standard installation paths
level: high

title: Mistic Backdoor C2 Check from Side-Loaded Process
id: AT-2026-06-26-182-sigma-2
status: experimental
description: Detects network connections from MpExtMs.exe, consistent with Mistic backdoor C2 communication
references:

  - https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579
author: Adverse Trace
date: 2026/06/26
logsource:
    product: windows
    category: network_connection
detection:
    selection:
        Image|endswith: '\MpExtMs.exe'
    filter_legitimate:
        Image|startswith:

            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\'
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate Microsoft Defender network telemetry from standard installation paths
level: medium

Threat actor context

Akira · G1024 · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. …

No MITRE ATT&CK profile for: KongTuke, Woodgnat, Qilin, Interlock, Rhysida, 8Base, Black Basta.

7. Sources

• The Register — "Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs" — https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579 — 2026-06-25
• Help Net Security — "Stealthy new backdoor emerges in attacks on multiple sectors" — https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/ — 2026-06-25
• The Hacker News — "New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns" — https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html — 2026-06-25
• BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke" — https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/ — 2026-06-25
• SecurityWeek — "New 'Mistic' RAT Opens Door to Several Ransomware Families" — https://www.securityweek.com/new-mistic-rat-opens-door-to-several-ransomware-families/ — 2026-06-25

8. Adverse Trace position

Severity assessment: . Mistic is a capable, stealthy backdoor with in-memory execution and self-destruct capabilities that complicate detection and forensic recovery. No CVE or patch is available — the initial access vector is social-engineering-based (ClickFix), meaning patching alone cannot mitigate the threat. The IAB-to-ransomware attack chain represents a credible threat to EMEA financial services, particularly insurance sub-sectors that match the observed targeting profile.

Attribution confidence: Low. The KongTuke/Woodgnat linkage is single-sourced to Symantec/Carbon Black and explicitly described as low confidence by the researchers themselves. KongTuke and Woodgnat have no MITRE ATT&CK profiles — attribution is unconfirmed. Of the named ransomware crews associated with KongTuke, only Akira (MITRE G1024) has a confirmed MITRE profile; Qilin, Interlock, Rhysida, 8Base, and Black Basta have no MITRE profiles and their involvement should be treated as unconfirmed.

Client-impact assessment: EMEA financial services clients with insurance operations are in the observed targeting profile. The ClickFix social-engineering vector and DLL side-loading technique are not sector-specific — any organisation with insufficient endpoint monitoring for side-loading and in-memory execution is potentially exposed. The self-destruct capability means that organisations relying primarily on file-based detection may miss Mistic entirely.

Next steps: Adverse Trace will continue monitoring for additional Mistic IOCs, C2 infrastructure, and ModeloRAT samples. We will update this advisory if attribution strengthens or if C2 domains/IPs emerge. Clients should deploy the YARA and Sigma rules provided in §6 and prioritise threat hunting in insurance-sector environments.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.