New Backdoor.Mistic RAT Emerges as Cybercrime Brokers Exploit Corporate Networks A recently identified remote access Trojan (RAT), dubbed Backdoor.Mistic (or MLTBackdoor by Zscaler), has been deployed by the Woodgnat hacking group since April 2026 to infiltrate corporate networks. Unlike traditional ransomware operators, Woodgnat functions as an initial access broker, compromising systems and selling network access to high-profile ransomware gangs, including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Active since May 2024, Woodgnat also tracked as KongTuke targets organizations indiscriminately, with recent victims spanning education, insurance, and IT services. The group employs ModeloRAT alongside Backdoor.Mistic to establish persistent access, often leveraging social engineering to trick employees. ### Deceptive Tactics: Browser Hijacks and Fake IT Support Woodgnat’s latest campaign, CrashFix (early 2026), involves hijacking WordPress sites to display fake technical alerts, freezing browsers and prompting victims to execute malicious commands. Similar schemes ClickFix and FileFix were used in 2025. Since April 2026, the group has also impersonated IT helpdesks via Microsoft Teams, convincing employees to run harmful scripts. Once executed, a multi-stage PowerShell attack deploys Backdoor.Mistic, which enables file manipulation, fake login screens for credential theft, and network reconnaissance using built-in Windows tools (Net.exe, Reg.exe, Curl). The RAT’s stealth is enhanced by DLL sideloading abusing trusted Windows files to evade detection and fileless execution, running entirely in memory to avoid antivirus scans. A self-destruct mechanism erases traces if detection is suspected. ### Cybercrime’s Industrialized Supply Chain Security firms including Symantec, Carbon Black, Zscaler, and ThaiCert have linked Woodgnat’s infrastructure to a growing trend: initial access brokers specializing in breaching networks for resale. Experts warn that defenders often focus on ransomware payloads while overlooking the upstream access infrastructure, which is the true enabler of attacks. Roman Sannikov of iCOUNTER emphasized that brokers like Woodgnat operate with consistent command-and-control (C2) patterns, hosting strategies, and handoff mechanisms, making their detection critical for preempting ransomware incidents. Josh Picolet of Team Cymru echoed this, noting that tracking these brokers’ routing, reuse patterns, and access handoffs provides the best opportunity to disrupt attacks before ransomware operators even enter the environment. The emergence of Backdoor.Mistic underscores the cybercrime ecosystem’s sophistication, where specialized actors monetize access while remaining hidden in plain sight.

Ransomware Attacks Hit Record Highs in 2025 Despite Major Disruptions A new study by Symantec and the Carbon Black Threat Hunter Team reveals that ransomware attacks surged to unprecedented levels in 2025, with threat actors adapting rapidly to law enforcement crackdowns and evolving their extortion tactics. The report documented 4,737 claimed ransomware attacks the highest annual total on record despite the collapse of two major operations. RansomHub, the most active group at the time, abruptly shut down in April 2025, causing a brief dip in activity. However, former affiliates quickly migrated to other groups, restoring attack volumes within weeks. LockBit (tracked as Syrphid) also failed to recover after late-2024 law enforcement actions. New leaders emerged to fill the void. Akira and Qilin each accounted for 16% of attacks, while Inc, Safepay, and the newly identified DragonForce contributed smaller but significant shares. The fluid movement of affiliates, access brokers, and tooling between groups sustained overall activity levels. Beyond traditional encryption-based ransomware, extortion campaigns without encryption surged in 2025. These attacks focused on data theft and public leaks pushed total extortion incidents to 6,182, a 23% increase from 2024. Snakefly’s Cl0p operation played a key role, exploiting vulnerabilities in enterprise software to target government and industrial sectors at scale. Social engineering also became a dominant attack vector, with groups like ShinyHunters and Scattered Spider using phone-based impersonation, credential harvesting, and OAuth abuse to breach cloud environments. Attackers tricked employees into authorizing malicious apps or sharing authentication codes, reducing reliance on malware. A new ransomware strain, Warlock, drew attention for its ties to older espionage tooling. Exploiting a zero-day in Microsoft SharePoint and using DLL sideloading, Warlock incorporated components linked to Chinese state-sponsored activity, blending ransomware with broader intrusion campaigns. Despite these shifts, attack chains remained consistent. Threat actors relied on "living off the land" techniques, leveraging PowerShell, remote management tools, and credential dumping to evade detection. Malware often appeared late in the intrusion, just before encryption or data theft. The findings underscore how ransomware operations continue to thrive, even as law enforcement disrupts key players, by diversifying extortion methods and exploiting shared infrastructure.