Mistic Backdoor Ties to IAB Selling Enterprise Footholds to Ransomware Gangs
A new in-memory backdoor named Mistic has been active since April, and the threat actor behind it has reportedly funneled access to Qilin, Akira, Black Basta, and others.
Woodgnat — also tracked as KongTuke — is not a ransomware operator. It is a supplier. The group breaks in, confirms the network is worth something, and sells the foothold. That business model is old news. What is new is the custom tooling it is now shipping with those intrusions.
Symantec's Threat Hunter Team published research this week on a backdoor they call Mistic, deployed across organizations in insurance, education, IT, and professional services since at least April. In practice, this matters because IABs have historically leaned hard on commodity loaders and living-off-the-land binaries — curl, PowerShell, certutil, reg.exe, WMIC. Custom implants signal a maturing operation that wants durable, stealthy access, not just a quick shell.
The failure mode here is a familiar one: DLL sideloading. The attackers drop a legitimately signed Microsoft Defender binary, MpExtMs.exe, which goes hunting for version.dll. That DLL then loads EndpointDlp.dll — which is actually Mistic. Running under a trusted Microsoft-signed process, inside a DLL named after a Microsoft data-loss-prevention component, the implant executes entirely in memory. No file dropped for your EDR to scan on write.
Once running, Mistic calls out to a C2, executes shellcode in memory, moves and exfiltrates files, and carries a kill switch — meaning operators can clean up before a forensics team gets close. A credential-stealing .NET DLL and ModeloRAT, a Python-based RAT also associated with Woodgnat, have been observed alongside it on victim networks.
The initial infection vector is ClickFix social engineering. Fake CAPTCHA pages, browser-crash lures prompting users to paste commands, and — new since April — Microsoft Teams impersonation where attackers pose as IT support and walk targets through paste-and-run sequences. That Teams vector is worth flagging to your platform team right now, because most orgs have external Teams federation enabled by default and almost nobody audits it.
Woodgnat has been active since at least May 2024 and has served Interlock, Rhysida, Akira, 8Base, and Black Basta. The Qilin ransomware connection surfaced through ModeloRAT deployments observed in recent campaigns.
Symantec's report includes indicators of compromise covering Mistic samples, ModeloRAT artifacts, and C2 infrastructure.
Operational takeaway: Block external Teams federation unless your business requires it, and alert on any process loading version.dll from a non-system path — it is a cheap detection with real signal.
