Mistic Backdoor Ties to IAB Selling Enterprise Footholds to Ransomware Gangs
A new in-memory backdoor named Mistic has been active since April, and the threat actor behind it has reportedly funneled access to Qilin, Akira, Black Basta, and others.
Key points
- Woodgnat (also tracked as KongTuke) operates as an initial access broker, breaking into networks and selling access to ransomware gangs rather than deploying ransomware itself.
- Its new custom backdoor, Mistic, uses DLL sideloading under a signed Microsoft Defender binary to execute entirely in memory, leaving nothing on disk for an EDR to catch on write.
- Woodgnat has supplied access to Interlock, Rhysida, Akira, 8Base, and Black Basta since at least May 2024; the Qilin connection emerged through ModeloRAT deployments in recent campaigns.
- A Teams impersonation vector added in April lets attackers pose as IT support and walk targets through paste-and-run sequences over external federation channels.
- Symantec's report includes indicators of compromise for Mistic, ModeloRAT, and associated C2 infrastructure.
What makes Mistic different from standard IAB tooling?
Woodgnat isn't a ransomware operator. It's a supplier. The group breaks in, confirms a network is worth selling, and moves on. That business model is old. The custom tooling it's now shipping with those intrusions is not.
Symantec's Threat Hunter Team published research this week on Mistic, deployed across insurance, education and IT organizations since at least April. IABs have historically leaned on commodity loaders and living-off-the-land binaries: curl, PowerShell, certutil, reg.exe, WMIC. Custom implants signal a maturing operation that wants durable, stealthy access rather than a quick shell. We reported a similar graduation when OnyxC2 brought DLL sideloading to commodity infostealer buyers on 11 June.
How does the DLL sideloading chain actually work?
DLL sideloading is the entry point. Attackers drop a legitimately signed Microsoft Defender binary, MpExtMs.exe, which searches for version.dll. That DLL loads EndpointDlp.dll, which is actually Mistic. Running under a trusted Microsoft-signed process and named after a Microsoft data-loss-prevention component, the implant executes entirely in memory.
Once running, Mistic reaches out to a C2 server, executes shellcode in memory, moves files, exfiltrates them, and carries a kill switch so operators can clean up before a forensics team arrives. A credential-stealing .NET DLL and ModeloRAT, a Python-based remote-access tool also tied to Woodgnat, have been observed alongside it on victim networks.
Should you worry about the Teams vector?
The initial infection route is ClickFix social engineering: fake CAPTCHA pages, browser-crash lures, and since April, Microsoft Teams impersonation where attackers pose as IT support and guide targets through paste-and-run steps. Flag that last one to your platform team now. Most organisations have external Teams federation enabled by default and almost nobody audits it.
Woodgnat has been active since at least May 2024, serving Interlock, Rhysida, Akira, 8Base, and Black Basta. The Qilin connection surfaced through ModeloRAT deployments in recent campaigns, a gang we've tracked through its affiliates before, most recently in our Check Point IKEv1 coverage on 9 June.
Operational takeaway: Block external Teams federation unless your business requires it, and alert on any process loading version.dll from a non-system path. It's a cheap detection with real signal.
