Stealthy new backdoor emerges in attacks on multiple sectors

1. Executive summary

Symantec and Carbon Black's Threat Hunter Team have identified a new backdoor dubbed Mistic (also tracked as MLTBackdoor by Zscaler) deployed in financially motivated attacks since April 2026. The malware is attributed to the initial access broker (IAB) Woodgnat (aka KongTuke), which sells durable enterprise access to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Targeted sectors include insurance, education, IT, and professional services — the insurance sector overlap is directly relevant to EMEA financial services clients. No CISA-KEV exploitation state or specific CVE is associated with this item; the threat is malware-driven, not vulnerability-driven. Attribution to Woodgnat/KongTuke is unconfirmed — neither actor has a MITRE ATT&CK profile in verified reference data. Actor "Akira" is confirmed as MITRE G1024; all other named actors (Woodgnat, KongTuke, Qilin, Interlock, Rhysida, 8Base, Black Basta) have no MITRE profiles and their attribution is treated as unconfirmed.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (corroborated across Symantec, BleepingComputer, The Hacker News, and SecurityWeek)

1. Initial access — Woodgnat's victim selection is described as "largely opportunistic" by Symantec. One observed intrusion vector involves a ClickFix campaign dubbed CrashFix (first reported by Huntress in January 2026), which used a malicious Chrome extension named NexShield, disguised as an ad blocker, to intentionally crash victims' browsers and trick users into running PowerShell commands leading to deployment of ModeloRAT.
2. ModeloRAT deployment — ModeloRAT is a Python-based remote access trojan developed by Woodgnat. It was observed deployed alongside Mistic in at least one intrusion.
3. Mistic side-loading — Mistic was side-loaded through MpExtMs.exe, a legitimate executable. The backdoor loaded from a DLL named EndpointDlp.dll — a name associated with Microsoft endpoint-security tooling, designed to blend in with trusted software.
4. Credential theft — Attackers loaded a .NET DLL on the victim network that displayed a fake login screen and stole credentials entered by users.
5. C2 communication — Once installed, Mistic communicates with its command-and-control infrastructure and receives instructions from the operator.
6. Living-off-the-land utilities — Attackers used several legitimate tools: Curl, Reg.exe, Net.exe, PowerShell, Certutil, and WMIC. These utilities enable file download, command execution, Windows registry modification, system information gathering, and interaction with remote hosts.

Mistic capabilities (confirmed, multi-source)

• File operations: upload, download, move, rename, delete files; create folders
• Command frequency modification: can modify how frequently it checks for commands from C2
• In-memory code execution: executes code received from the C2 server directly in memory
• Kill switch: can terminate and remove itself from an infected system
• Stealth: in-memory execution plus built-in kill switch designed for long-term undetected access

Attribution caveat: The attribution to Woodgnat/KongTuke is single-sourced to Symantec with corroboration from BleepingComputer, The Hacker News, and SecurityWeek — all of which reference Symantec as the primary source. No independent technical attribution from a second vendor's telemetry is present. Woodgnat and KongTuke have no MITRE ATT&CK profiles in verified reference data; attribution is treated as unconfirmed. Actor "Akira" is confirmed as MITRE G1024. All other named ransomware affiliates (Qilin, Interlock, Rhysida, 8Base, Black Basta) have no MITRE profiles — their connection to Woodgnat is unconfirmed.

Geographic scope: Woodgnat's geographic location remains unknown (Symantec). No specific EMEA targeting is confirmed in the source material, though the insurance sector is explicitly named as a target vertical.

4. Mitigation & containment

P1 — Within 24 hours

• Block DLL side-loading for MpExtMs.exe — If this binary is not a legitimate required executable in your environment, block its execution via application whitelisting / EDR. If it is legitimate, enforce DLL path resolution to trusted directories only (Windows mitigation: ForceMitigationOptions or WDAC policy).
• Alert on EndpointDlp.dll — Search endpoint telemetry for any file named EndpointDlp.dll loaded by processes other than the legitimate Microsoft Defender endpoint agent. This filename is being abused to impersonate Microsoft security tooling.
• Hunt for Mistic C2 traffic — Symantec has published IOCs including IP addresses; ingest these into SIEM, firewall, and proxy deny-lists immediately (see §5).
• Alert on in-memory .NET assembly loading — Configure EDR to alert on Assembly.Load or Invoke-Assembly from non-standard processes, particularly those spawned by LOLBins (Certutil, WMIC, Curl).
• Alert on fake login screens — Hunt for .NET DLLs loaded into credential-handling processes (lsass, logonui, winlogon) that are not digitally signed by Microsoft.

P2 — Within 72 hours

• Audit LOLBin usage — Review SIEM logs for suspicious use of certutil.exe (especially -decode or -urlcache flags), wmic.exe with process call create, curl.exe downloading executables, and net.exe for network enumeration. These are confirmed TTPs in this campaign.
• Hunt for ModeloRAT — Search for Python-based executables or scripts exhibiting C2 behaviour, particularly those associated with Chrome extension NexShield. Huntress first reported ModeloRAT in January 2026 — review endpoint logs from January onwards.
• Review Chrome extension policies — Ensure enterprise Chrome policies block unsigned/unapproved extensions. Specifically block NexShield by name if present in your environment.
• Audit PowerShell execution — Review logs for PowerShell processes spawned by browser processes or browser crash handlers, which would indicate ClickFix/CrashFix-style social engineering.

P3 — Within 7 days

• Conduct a DLL side-loading audit — Inventory all executables in your environment that are vulnerable to DLL side-loading (searchable via Process Monitor or EDR telemetry). Prioritize binaries with security-product-sounding DLL names.
• Review credential-handling controls — Ensure that any .NET assemblies loaded in the context of authentication processes are code-signed and whitelisted.
• Tabletop exercise — Run a DORA Art. 24 digital operational resilience test scenario based on this attack chain: initial access via social engineering → backdoor side-loading → credential theft → C2 beaconing → potential ransomware deployment. Validate detection at each stage.

5. Indicators of compromise

Symantec has published a list of IOCs for Mistic, including malicious files and IP addresses. However, the specific IOC values (hashes, IPs, domains) are not included in the provided source material — the sources reference their existence but do not enumerate them.

Confidence caveat: Specific file hashes, IP addresses, and domain IOCs referenced by Symantec are not present in the provided source material. Clients should retrieve the IOC list directly from Symantec's published research. The filenames and tool names above are corroborated across multiple sources.

filename  MpExtMs.exe
filename  EndpointDlp.dll
filename  NexShield
toolname  ModeloRAT
toolname  Mistic
toolname  MLTBackdoor

6. Detection

YARA rule — Mistic backdoor artefacts

rule Mistic_Backdoor_Artifacts {
    meta {
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/"
        description = "Detects artefacts associated with Mistic/MLTBackdoor side-loading via MpExtMs.exe and EndpointDlp.dll"
    }
    strings:
        $dll_name = "EndpointDlp.dll" nocase
        $exe_name = "MpExtMs.exe" nocase
        $ext_name = "NexShield" nocase
    condition:
        2 of them
}

Sigma rule — DLL side-loading via MpExtMs.exe

title: Mistic Backdoor DLL Side-Loading via MpExtMs.exe
id: AT-2026-06-25-180-sigma-1
status: experimental
description: Detects EndpointDlp.dll being loaded by MpExtMs.exe, consistent with Mistic backdoor side-loading technique
references:

    - https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/
    - https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/
    - https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html
author: Adverse Trace
date: 2026/06/25
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith: '\MpExtMs.exe'
        ImageLoaded|endswith: '\EndpointDlp.dll'
    condition: selection
falsepositives:

    - Legitimate Microsoft Defender endpoint DLL with identical name (verify signature and path)
level: high

Sigma rule — LOLBin suspicious execution pattern

title: Woodgnat Campaign LOLBin Execution Pattern
id: AT-2026-06-25-180-sigma-2
status: experimental
description: Detects suspicious use of LOLBins (Certutil, WMIC, Curl, Net) consistent with Woodgnat/Mistic attack chain
references:

    - https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/
    - https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html
author: Adverse Trace
date: 2026/06/25
logsource:
    product: windows
    category: process_creation
detection:
    selection_certutil:
        Image|endswith: '\certutil.exe'
        CommandLine|contains:

            - '-urlcache'
            - '-decode'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    selection_curl:
        Image|endswith: '\curl.exe'
        CommandLine|contains:

            - 'http://'
            - 'https://'
    selection_net:
        Image|endswith: '\net.exe'
        CommandLine|contains:

            - 'view'
            - 'user'
            - 'group'
    condition: 1 of selection_*
falsepositives:

    - Legitimate administrative use of these utilities
level: medium

Threat actor context

Akira · G1024 · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. …

No MITRE ATT&CK profile for: Woodgnat, KongTuke, Qilin, Interlock, Rhysida, 8Base, Black Basta.

7. Sources

• Help Net Security — "Stealthy new backdoor emerges in attacks on multiple sectors" — https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/ — 2026-06-25
• BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke" — https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/ — 2026-06-25
• The Hacker News — "New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns" — https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html — 2026-06-25
• SecurityWeek — "New 'Mistic' RAT Opens Door to Several Ransomware Families" — https://www.securityweek.com/new-mistic-rat-opens-door-to-several-ransomware-families/ — 2026-06-25

8. Adverse Trace position

This is a * item. No CVE or CISA-KEV exploitation state is associated with this threat — it is a malware-driven campaign, not a vulnerability exploitation. The threat is credible and multi-source corroborated across four independent security publications, all ultimately sourcing to Symantec with additional reporting from Zscaler (MLTBackdoor) and Huntress (ModeloRAT/ClickFix). Attribution to Woodgnat/KongTuke is *unconfirmed — no MITRE ATT&CK profile exists for either designation. The connection to named ransomware affiliates (Qilin, Interlock, Rhysida, 8Base, Black Basta) is similarly unconfirmed; only "Akira" has a confirmed MITRE profile (G1024). The insurance sector is explicitly named as a target vertical, which directly elevates relevance for EMEA financial services clients with insurance operations. The attack chain is technically sound: DLL side-loading via legitimate Microsoft-named binaries, in-memory execution, fake login screens for credential theft, and extensive LOLBin abuse are all well-established TTPs. The absence of specific IOC values (hashes, IPs) in the source material limits immediate enforcement — clients should retrieve Symantec's published IOC list directly. Adverse Trace will continue to monitor for: (a) Symantec's full IOC publication, (b) any EMEA-specific targeting data, (c) independent attribution corroboration from a second vendor's telemetry, and (d) any CISA-KEV or CVE association if a specific vulnerability is later identified in the initial access chain.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.