Mistic Backdoor Tied to KongTuke Access Broker Supplying Ransomware Crews

Researchers have identified a stealthy new backdoor, Mistic—also tracked as MTLBackdoor and Backdoor.Mistic—in financially motivated intrusions targeting organizations in the insurance, education, IT, and professional services sectors. Symantec said the malware has been used since April and is likely linked to the initial access broker KongTuke/Woodgnat, which has been associated with selling enterprise access to ransomware groups including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. In one intrusion, Mistic appeared alongside Woodgnat's previously documented ModeloRAT, strengthening the attribution.

Mistic was observed being loaded through DLL side-loading via the legitimate MpExtMs.exe process with a malicious version.dll, while a separate .NET DLL displayed a fake login screen to steal credentials. The malware supports file operations, configurable beaconing, in-memory payload execution, and a self-delete function designed to reduce forensic visibility and maintain long-term access. Zscaler also reported Mistic in a multi-stage ClickFix infection chain and said it can load Beacon Object Files to expand post-exploitation capabilities without writing artifacts to disk, underscoring its role as a stealthy access tool in ransomware-linked intrusions.