> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Stealthy new backdoor emerges in attacks on multiple sectors - URL: https://f4n6.co.uk/security-feed/stealthy-new-backdoor-emerges-in-attacks-on-multiple-sectors/ - Published: 2026-06-25T18:48:21.000Z - Updated: 2026-06-25T18:48:21.000Z - Author: Jeff Davies - Tags: #security-feed, Woodgnat, KongTuke, qilin, Interlock, Rhysida ## 1\. Executive summary Symantec and Carbon Black's Threat Hunter Team have identified a new backdoor dubbed **Mistic** (also tracked as **MLTBackdoor** by Zscaler) deployed in financially motivated attacks since April 2026\. The malware is attributed to the initial access broker (IAB) **Woodgnat** (aka **KongTuke**), which sells durable enterprise access to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Targeted sectors include insurance, education, IT, and professional services — the insurance sector overlap is directly relevant to EMEA financial services clients. No CISA-KEV exploitation state or specific CVE is associated with this item; the threat is malware-driven, not vulnerability-driven. Attribution to Woodgnat/KongTuke is **unconfirmed** — neither actor has a MITRE ATT&CK profile in verified reference data. Actor "Akira" is confirmed as MITRE G1024; all other named actors (Woodgnat, KongTuke, Qilin, Interlock, Rhysida, 8Base, Black Basta) have no MITRE profiles and their attribution is treated as unconfirmed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17: ICT-related incident management process | Active backdoor (Mistic) with C2 communication and in-memory execution establishing durable remote access in enterprise environments | Financial entities must have an incident management process capable of detecting and responding to stealthy backdoor persistence; this item illustrates the class of ICT incident that Art. 17 requires entities to be prepared to manage. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Mistic is a confirmed active threat with multi-sector targeting and links to ransomware affiliates | Entities must classify this threat appropriately — a backdoor linked to ransomware IAB activity constitutes a high-severity cyber threat requiring classification under Art. 18. | | NIS2 Art. 21(2)(d): supply chain security measures | Attack chain abuses legitimate executables and LOLBins (Curl, Reg.exe, Net.exe, PowerShell, Certutil, WMIC) and side-loads via legitimate Microsoft endpoint tooling filenames | Supply chain security measures must account for abuse of legitimate signed binaries and living-off-the-land techniques; third-party tooling and endpoint security products are being impersonated. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | Stealthy backdoor with in-memory execution and kill switch designed for long-term undetected access | OES and RDSP operators must ensure monitoring and detection capabilities cover fileless/in-memory execution and DLL side-loading techniques. | ## 3\. Technical analysis & attack chain ### Confirmed attack chain (corroborated across Symantec, BleepingComputer, The Hacker News, and SecurityWeek) 1. **Initial access** — Woodgnat's victim selection is described as "largely opportunistic" by Symantec. One observed intrusion vector involves a **ClickFix campaign dubbed CrashFix** (first reported by Huntress in January 2026), which used a malicious Chrome extension named **NexShield**, disguised as an ad blocker, to intentionally crash victims' browsers and trick users into running PowerShell commands leading to deployment of **ModeloRAT**. 2. **ModeloRAT deployment** — ModeloRAT is a **Python-based remote access trojan** developed by Woodgnat. It was observed deployed alongside Mistic in at least one intrusion. 3. **Mistic side-loading** — Mistic was side-loaded through **MpExtMs.exe**, a legitimate executable. The backdoor loaded from a DLL named **EndpointDlp.dll** — a name associated with Microsoft endpoint-security tooling, designed to blend in with trusted software. 4. **Credential theft** — Attackers loaded a **.NET DLL** on the victim network that displayed a **fake login screen** and stole credentials entered by users. 5. **C2 communication** — Once installed, Mistic communicates with its command-and-control infrastructure and receives instructions from the operator. 6. **Living-off-the-land utilities** — Attackers used several legitimate tools: **Curl**, **Reg.exe**, **Net.exe**, **PowerShell**, **Certutil**, and **WMIC**. These utilities enable file download, command execution, Windows registry modification, system information gathering, and interaction with remote hosts. ### Mistic capabilities (confirmed, multi-source) - File operations: upload, download, move, rename, delete files; create folders - Command frequency modification: can modify how frequently it checks for commands from C2 - In-memory code execution: executes code received from the C2 server directly in memory - Kill switch: can terminate and remove itself from an infected system - Stealth: in-memory execution plus built-in kill switch designed for long-term undetected access **Attribution caveat:** The attribution to Woodgnat/KongTuke is **single-sourced to Symantec** with corroboration from BleepingComputer, The Hacker News, and SecurityWeek — all of which reference Symantec as the primary source. No independent technical attribution from a second vendor's telemetry is present. Woodgnat and KongTuke have no MITRE ATT&CK profiles in verified reference data; attribution is treated as **unconfirmed**. Actor "Akira" is confirmed as MITRE G1024\. All other named ransomware affiliates (Qilin, Interlock, Rhysida, 8Base, Black Basta) have no MITRE profiles — their connection to Woodgnat is unconfirmed. **Geographic scope:** Woodgnat's geographic location remains unknown (Symantec). No specific EMEA targeting is confirmed in the source material, though the insurance sector is explicitly named as a target vertical. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block DLL side-loading for MpExtMs.exe** — If this binary is not a legitimate required executable in your environment, block its execution via application whitelisting / EDR. If it is legitimate, enforce DLL path resolution to trusted directories only (Windows mitigation: `ForceMitigationOptions` or WDAC policy). - **Alert on EndpointDlp.dll** — Search endpoint telemetry for any file named `EndpointDlp.dll` loaded by processes other than the legitimate Microsoft Defender endpoint agent. This filename is being abused to impersonate Microsoft security tooling. - **Hunt for Mistic C2 traffic** — Symantec has published IOCs including IP addresses; ingest these into SIEM, firewall, and proxy deny-lists immediately (see §5). - **Alert on in-memory .NET assembly loading** — Configure EDR to alert on `Assembly.Load` or `Invoke-Assembly` from non-standard processes, particularly those spawned by LOLBins (Certutil, WMIC, Curl). - **Alert on fake login screens** — Hunt for .NET DLLs loaded into credential-handling processes (lsass, logonui, winlogon) that are not digitally signed by Microsoft. ### P2 — Within 72 hours - **Audit LOLBin usage** — Review SIEM logs for suspicious use of `certutil.exe` (especially `-decode` or `-urlcache` flags), `wmic.exe` with `process call create`, `curl.exe` downloading executables, and `net.exe` for network enumeration. These are confirmed TTPs in this campaign. - **Hunt for ModeloRAT** — Search for Python-based executables or scripts exhibiting C2 behaviour, particularly those associated with Chrome extension `NexShield`. Huntress first reported ModeloRAT in January 2026 — review endpoint logs from January onwards. - **Review Chrome extension policies** — Ensure enterprise Chrome policies block unsigned/unapproved extensions. Specifically block `NexShield` by name if present in your environment. - **Audit PowerShell execution** — Review logs for PowerShell processes spawned by browser processes or browser crash handlers, which would indicate ClickFix/CrashFix-style social engineering. ### P3 — Within 7 days - **Conduct a DLL side-loading audit** — Inventory all executables in your environment that are vulnerable to DLL side-loading (searchable via `Process Monitor` or EDR telemetry). Prioritize binaries with security-product-sounding DLL names. - **Review credential-handling controls** — Ensure that any .NET assemblies loaded in the context of authentication processes are code-signed and whitelisted. - **Tabletop exercise** — Run a DORA Art. 24 digital operational resilience test scenario based on this attack chain: initial access via social engineering → backdoor side-loading → credential theft → C2 beaconing → potential ransomware deployment. Validate detection at each stage. ## 5\. Indicators of compromise Symantec has published a list of IOCs for Mistic, including malicious files and IP addresses. However, the specific IOC values (hashes, IPs, domains) are **not included in the provided source material** — the sources reference their existence but do not enumerate them. | Type | Value | Confidence | Source | | -------- | ---------------------------- | -------------------------------------------- | ----------------------------------------------------------------- | | filename | MpExtMs.exe | High — multi-source corroborated | Symantec via Help Net Security, BleepingComputer, The Hacker News | | filename | EndpointDlp.dll | High — multi-source corroborated | Symantec via Help Net Security, BleepingComputer, The Hacker News | | filename | NexShield (Chrome extension) | High — corroborated by Huntress and Symantec | Huntress (January 2026) via Symantec | | tool | ModeloRAT (Python-based RAT) | High — multi-source corroborated | Huntress, Symantec via multiple sources | | tool | Mistic / MLTBackdoor | High — multi-source corroborated | Symantec, Zscaler via multiple sources | **Confidence caveat:** Specific file hashes, IP addresses, and domain IOCs referenced by Symantec are **not present in the provided source material**. Clients should retrieve the IOC list directly from Symantec's published research. The filenames and tool names above are corroborated across multiple sources. ```iocs filename MpExtMs.exe filename EndpointDlp.dll filename NexShield toolname ModeloRAT toolname Mistic toolname MLTBackdoor ``` ## 6\. Detection ### YARA rule — Mistic backdoor artefacts ```yara rule Mistic_Backdoor_Artifacts { meta { author = "Adverse Trace" date = "2026-06-25" reference = "https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/" description = "Detects artefacts associated with Mistic/MLTBackdoor side-loading via MpExtMs.exe and EndpointDlp.dll" } strings: $dll_name = "EndpointDlp.dll" nocase $exe_name = "MpExtMs.exe" nocase $ext_name = "NexShield" nocase condition: 2 of them } ``` ### Sigma rule — DLL side-loading via MpExtMs.exe ```yaml title: Mistic Backdoor DLL Side-Loading via MpExtMs.exe id: AT-2026-06-25-180-sigma-1 status: experimental description: Detects EndpointDlp.dll being loaded by MpExtMs.exe, consistent with Mistic backdoor side-loading technique references: - https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/ - https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/ - https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html author: Adverse Trace date: 2026/06/25 logsource: product: windows category: image_load detection: selection: Image|endswith: '\MpExtMs.exe' ImageLoaded|endswith: '\EndpointDlp.dll' condition: selection falsepositives: - Legitimate Microsoft Defender endpoint DLL with identical name (verify signature and path) level: high ``` ### Sigma rule — LOLBin suspicious execution pattern ```yaml title: Woodgnat Campaign LOLBin Execution Pattern id: AT-2026-06-25-180-sigma-2 status: experimental description: Detects suspicious use of LOLBins (Certutil, WMIC, Curl, Net) consistent with Woodgnat/Mistic attack chain references: - https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/ - https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html author: Adverse Trace date: 2026/06/25 logsource: product: windows category: process_creation detection: selection_certutil: Image|endswith: '\certutil.exe' CommandLine|contains: - '-urlcache' - '-decode' selection_wmic: Image|endswith: '\wmic.exe' CommandLine|contains: 'process call create' selection_curl: Image|endswith: '\curl.exe' CommandLine|contains: - 'http://' - 'https://' selection_net: Image|endswith: '\net.exe' CommandLine|contains: - 'view' - 'user' - 'group' condition: 1 of selection_* falsepositives: - Legitimate administrative use of these utilities level: medium ``` ## Threat actor context **Akira** · [G1024](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius [Akira](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) is a ransomware variant and ransomware deployment entity active since at least March 2023\. [Akira](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. … *No MITRE ATT&CK profile for: Woodgnat, KongTuke, Qilin, Interlock, Rhysida, 8Base, Black Basta.* ## 7\. Sources - Help Net Security — "Stealthy new backdoor emerges in attacks on multiple sectors" — https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/ — 2026-06-25 - BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke" — https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/ — 2026-06-25 - The Hacker News — "New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns" — https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html — 2026-06-25 - SecurityWeek — "New 'Mistic' RAT Opens Door to Several Ransomware Families" — https://www.securityweek.com/new-mistic-rat-opens-door-to-several-ransomware-families/ — 2026-06-25 ## 8\. Adverse Trace position This is a ***\* item. No CVE or CISA-KEV exploitation state is associated with this threat — it is a malware-driven campaign, not a vulnerability exploitation. The threat is credible and multi-source corroborated across four independent security publications, all ultimately sourcing to Symantec with additional reporting from Zscaler (MLTBackdoor) and Huntress (ModeloRAT/ClickFix). Attribution to Woodgnat/KongTuke is* \*unconfirmed** — no MITRE ATT&CK profile exists for either designation. The connection to named ransomware affiliates (Qilin, Interlock, Rhysida, 8Base, Black Basta) is similarly unconfirmed; only "Akira" has a confirmed MITRE profile (G1024). The insurance sector is explicitly named as a target vertical, which directly elevates relevance for EMEA financial services clients with insurance operations. The attack chain is technically sound: DLL side-loading via legitimate Microsoft-named binaries, in-memory execution, fake login screens for credential theft, and extensive LOLBin abuse are all well-established TTPs. The absence of specific IOC values (hashes, IPs) in the source material limits immediate enforcement — clients should retrieve Symantec's published IOC list directly. Adverse Trace will continue to monitor for: (a) Symantec's full IOC publication, (b) any EMEA-specific targeting data, (c) independent attribution corroboration from a second vendor's telemetry, and (d) any CISA-KEV or CVE association if a specific vulnerability is later identified in the initial access chain. --- [Read the original source →](https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*