New Backdoor.Mistic RAT Emerges as Cybercrime Brokers Exploit Corporate Networks A recently identified remote access Trojan (RAT), dubbed Backdoor.Mistic (or MLTBackdoor by Zscaler), has been deployed by the Woodgnat hacking group since April 2026 to infiltrate corporate networks. Unlike traditional ransomware operators, Woodgnat functions as an initial access broker, compromising systems and selling network access to high-profile ransomware gangs, including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Active since May 2024, Woodgnat also tracked as KongTuke targets organizations indiscriminately, with recent victims spanning education, insurance, and IT services. The group employs ModeloRAT alongside Backdoor.Mistic to establish persistent access, often leveraging social engineering to trick employees. ### Deceptive Tactics: Browser Hijacks and Fake IT Support Woodgnat’s latest campaign, CrashFix (early 2026), involves hijacking WordPress sites to display fake technical alerts, freezing browsers and prompting victims to execute malicious commands. Similar schemes ClickFix and FileFix were used in 2025. Since April 2026, the group has also impersonated IT helpdesks via Microsoft Teams, convincing employees to run harmful scripts. Once executed, a multi-stage PowerShell attack deploys Backdoor.Mistic, which enables file manipulation, fake login screens for credential theft, and network reconnaissance using built-in Windows tools (Net.exe, Reg.exe, Curl). The RAT’s stealth is enhanced by DLL sideloading abusing trusted Windows files to evade detection and fileless execution, running entirely in memory to avoid antivirus scans. A self-destruct mechanism erases traces if detection is suspected. ### Cybercrime’s Industrialized Supply Chain Security firms including Symantec, Carbon Black, Zscaler, and ThaiCert have linked Woodgnat’s infrastructure to a growing trend: initial access brokers specializing in breaching networks for resale. Experts warn that defenders often focus on ransomware payloads while overlooking the upstream access infrastructure, which is the true enabler of attacks. Roman Sannikov of iCOUNTER emphasized that brokers like Woodgnat operate with consistent command-and-control (C2) patterns, hosting strategies, and handoff mechanisms, making their detection critical for preempting ransomware incidents. Josh Picolet of Team Cymru echoed this, noting that tracking these brokers’ routing, reuse patterns, and access handoffs provides the best opportunity to disrupt attacks before ransomware operators even enter the environment. The emergence of Backdoor.Mistic underscores the cybercrime ecosystem’s sophistication, where specialized actors monetize access while remaining hidden in plain sight.