Mistic backdoor deployed by Woodgnat in ransomware attacks

A new stealthy backdoor called Mistic has been deployed in attacks against multiple industry sectors since April, according to cybersecurity researchers. The malware is linked to a financially motivated cybercriminal group known for selling network access to prominent ransomware gangs.

The threat actor, tracked as Woodgnat or KongTuke, is an initial access broker that has been active since at least May 2024. Its business model involves compromising corporate networks and then selling that persistent access to ransomware affiliates for a fee. The group has been associated with operations involving the Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta ransomware strains.

Mistic has been used in opportunistic attacks targeting organizations in the insurance, education, information technology, and professional services sectors. In at least one intrusion, it was deployed alongside another tool attributed to the same group, a Python-based remote access trojan called ModeloRAT.

The infection chain is designed for camouflage. Attackers use a technique called DLL sideloading, initiating the process with a legitimate, digitally signed Microsoft executable file named MpExtMs.exe....