New Mistic Backdoor Linked to KongTuke Initial Access Broker in Targeted Attacks A newly identified backdoor, dubbed Mistic, has been deployed in financially motivated cyberattacks targeting organizations in the insurance, education, IT, and professional services sectors. The malware is attributed to KongTuke (also known as Woodgnat), an initial access broker (IAB) active since at least 2024, which specializes in breaching corporate networks and selling access to ransomware groups, including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Researchers at Symantec first observed Mistic in intrusions beginning in April 2024, with at least one attack involving its deployment shortly after ModeloRAT another backdoor linked to KongTuke was delivered via social engineering over Microsoft Teams. Designed for stealth and long-term persistence, Mistic enables attackers to maintain covert access to compromised networks. ### Attack Chain & Capabilities The infection process begins with the execution of a legitimate MpExtMs.exe binary to side-load a malicious version.dll, which acts as a loader for Mistic (disguised as EndpointDlp.dll). The filename mimics Microsoft endpoint security tools, aiding evasion. A secondary .NET DLL is also deployed, displaying a fake login screen to harvest credentials. Once active, Mistic establishes communication with its command-and-control (C2) server and supports multiple functions, including: - File manipulation (upload/download, move, rename, delete, and folder creation) - Adjustable C2 polling frequency - In-memory code execution (avoiding disk writes) - Self-termination and file deletion via a kill switch Symantec highlights Mistic’s in-memory execution and self-destruct features as key to its low-visibility operations, aligning with KongTuke’s focus on prolonged network access. ### Delivery & Additional Tools While Symantec did not detail the initial infection vector, KongTuke has previously used ClickFix (and variants FileFix and CrashFix) since early 2025 to deploy ModeloRAT. In a separate report, Zscaler which tracks Mistic as MTLBackdoor noted its delivery in a May 2024 multi-stage ClickFix attack chain. A notable feature of MTLBackdoor is its ability to load Beacon Object Files (BOFs), small C-based programs that execute in memory, leaving no disk footprint a technique common in red teaming tools like Cobalt Strike. KongTuke’s arsenal extends beyond Mistic, incorporating legitimate tools (WinPython, Node.js) and malware loaders (MintsLoader, D3F@ck Loader) to deploy additional payloads, including the GateKeeper .NET payload and the NexShield browser extension. ### Broader Implications The emergence of Mistic underscores a growing trend of custom backdoors in ransomware operations, developed by IABs with direct ties to cybercriminal ecosystems. Both Symantec and Zscaler have released indicators of compromise (IoCs) for detection, emphasizing the malware’s stealth and modular expansion capabilities.