Researchers Detail Backdoor.Mistic’s DLL Sideloading and In-Memory Capabilities
Summary
Researchers describe Backdoor.Mistic, observed in intrusions since April 2026, using DLL sideloading and in-memory execution. It appeared alongside ModeloRAT in one intrusion; a link to Woodgnat remains possible, not confirmed.
Key points
- Symantec researchers observed Backdoor.Mistic in multiple intrusions since April 2026; Zscaler previously documented it as MLTBackdoor.
- A loader used MpExtMs.exe to sideload malicious EndpointDlp.dll; hooks to GetModuleFileNameW and LoadLibraryW helped control execution.
- Mistic can run payloads in memory, manipulate files, and terminate and delete itself using a kill switch.
- Reported deployments affected organizations in insurance, education, IT, and professional services; researchers describe the targeting as opportunistic.
- Mistic appeared alongside ModeloRAT in one intrusion. Researchers say a link to Woodgnat is possible; their team separately observed ModeloRAT in attacks delivering Qilin ransomware.
- The article describes Woodgnat tradecraft including ClickFix, FileFix, and CrashFix lures, PowerShell execution, reconnaissance, persistence, and data staging and exfiltration over HTTP.
Article Details
- Attack Vectors
- MpExtMs.exe was used to sideload the malicious EndpointDlp.dll backdoor; a loader named version.dll hooked GetModuleFileNameW and LoadLibraryW.
- ClickFix, FileFix, and CrashFix lures, as well as helpdesk and IT-support pretexts in external Microsoft Teams chats, tricked users into pasting and executing attacker-supplied commands.
- PowerShell chains downloaded payloads and a portable WinPython environment, then launched ModeloRAT.
- The operators used Windows tooling for reconnaissance, including enumerating domain users, groups, computers, and sessions, and performing Kerberoasting queries.
- The activity used redundant persistence mechanisms, including Run-key entries, Startup-folder shortcuts, VBScript launchers, and scheduled tasks.
- ModeloRAT used RC4-encrypted C2 communications; data was staged and exfiltrated over HTTP using curl.exe.
- Defensive Notes
- The article directs readers to the Symantec Protection Bulletin for the latest protection updates; it provides no specific mitigation steps in the supplied content.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | authorized-logins[.]net | Listed as lure, update, or C2-related infrastructure associated with the reported activity. |
| DOMAIN | b6w9m2z5x8q1v3k[.]top | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | defs[.]updater-worelos[.]com | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | ftps[.]upd-domain-goloro[.]com | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | human-check[.]top | Listed as lure or related network infrastructure associated with the reported activity. |
| DOMAIN | mail[.]authorized-logins[.]net | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | mailes[.]upd-domain-goloro[.]com | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | mails[.]updater-worelos[.]com | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | nano[.]upscale-kolo[.]com | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | php[.]authorized-logins[.]net | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | rotoa-upda-lo[.]com | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | sql-updater-service[.]com | Listed as update or related network infrastructure associated with the reported activity. |
| DOMAIN | sss[.]authorized-logins[.]net | Listed as network infrastructure associated with the reported activity. |
| DOMAIN | upd-domain-goloro[.]com | Listed as update or related network infrastructure associated with the reported activity. |
| DOMAIN | update[.]update-fall[.]com | Listed as update or related network infrastructure associated with the reported activity. |
| DOMAIN | updater-worelos[.]com | Listed as update or related network infrastructure associated with the reported activity. |
| IPV4 | 142[.]93[.]242[.]144 | Listed among IP indicators for command-and-control or related infrastructure. |
| IPV4 | 144[.]31[.]53[.]78 | Listed among IP indicators for command-and-control or related infrastructure. |
| IPV4 | 198[.]13[.]159[.]44 | Listed among IP indicators for command-and-control or related infrastructure. |
| IPV4 | 199[.]91[.]221[.]42 | Listed among IP indicators for command-and-control or related infrastructure. |
| SHA256 | 1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984 | Identified as a Backdoor.Mistic file hash for endpointdlp.dll. |
| SHA256 | 34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc | Identified as the hash of a fake lock-screen file, f.dll. |
| SHA256 | 3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be | Identified as a Backdoor.Mistic file hash for aeff97fe.msi. |
| SHA256 | 59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712 | Identified as the loader hash for version.dll. |
| SHA256 | 8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235 | Identified as a likely privilege-escalation file hash for n.dll. |
| SHA256 | afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c | Identified as a Backdoor.Mistic file hash for endpointdlp.dll. |
| SHA256 | db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5 | Identified as a Backdoor.Mistic file hash for endpointdlp.dll. |
| SHA256 | f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e | Identified as a Backdoor.Mistic file hash for 48b47c0.msi. |
| SHA256 | fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a | Identified as a Backdoor.Mistic file hash for endpointdlp.dll. |
| URL | hxxp[:]//thomphon[.]com/update.msi | Listed as a downloader or lure URL for an MSI file. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe operators enumerated computers and sessions across the environment.T1027 · Obfuscated Files or InformationThe reported tradecraft used obfuscation, layered encryption, and a domain-generation algorithm.T1053.005 · Scheduled TaskScheduled tasks were used as one of several persistence mechanisms.T1059.001 · PowerShellAttacker-supplied PowerShell commands were used to download payloads, traverse networks, and run commands.T1071.001 · Web ProtocolsThe article reports data staging and exfiltration over HTTP using curl.exe.T1087.002 · Domain AccountThe operators enumerated domain users and groups with net.exe.T1105 · Ingress Tool TransferPowerShell and curl were used to download payloads and components.T1106 · Native APIThe version.dll loader hooked GetModuleFileNameW and LoadLibraryW to control execution and DLL loading.T1112 · Modify RegistryRegistry edits were used to establish persistence, including Run-key entries.T1113 · Screen CaptureThe operators were observed capturing screenshots.T1204.002 · Malicious FileClickFix, FileFix, CrashFix, and Teams pretexts tricked users into pasting and running attacker-supplied commands.T1547.001 · Registry Run Keys / Startup FolderPersistence included Run-key entries, including entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.T1558.003 · KerberoastingThe operators performed Kerberoasting queries against accounts with service principal names to harvest crackable credentials.T1574.002 · DLL Side-LoadingMpExtMs.exe was used to sideload the malicious EndpointDlp.dll backdoor.
Threat Actors
8baseThe article says Woodgnat has been publicly linked to 8Base attacks; it does not establish a direct connection between 8Base and Backdoor.Mistic.AkiraThe article says Woodgnat has been publicly linked to Akira attacks; it does not establish a direct connection between Akira and Backdoor.Mistic.Black BastaThe article says Woodgnat has been publicly linked to Black Basta attacks; it does not establish a direct connection between Black Basta and Backdoor.Mistic.InterlockThe article says Woodgnat has been publicly linked to Interlock attacks; it does not establish a direct connection between Interlock and Backdoor.Mistic.QilinThe article reports that ModeloRAT was observed in attacks delivering Qilin ransomware and that Woodgnat has been publicly linked to Qilin attacks.RhysidaThe article says Woodgnat has been publicly linked to Rhysida attacks; it does not establish a direct connection between Rhysida and Backdoor.Mistic.WoodgnatDescribed as a financially motivated initial access broker associated with ModeloRAT and publicly linked to attacks involving multiple ransomware operations. Its possible role in developing or deploying Backdoor.Mistic is presented as uncertain.
Malware
Backdoor.MisticBackdoor.Mistic is a stealthy new backdoor used in cybercrime intrusions since April 2026, and it has appeared alongside ModeloRAT in activity linked to Woodgnat.D3F@ck LoaderMintsLoader and D3F@ck Loader: Commodity loaders used to stage follow-on payloads.GateKeeperGateKeeper: A .NET payload featuring layered encryption and extensive anti-analysis and victim-fingerprinting logic.MintsLoaderMintsLoader and D3F@ck Loader: Commodity loaders used to stage follow-on payloads.ModeloRATBackdoor.Mistic is a stealthy new backdoor used in cybercrime intrusions since April 2026, and it has appeared alongside ModeloRAT in activity linked to Woodgnat.NexShieldNexShield: A malicious Chrome extension impersonating uBlock Origin Lite, distributed via malvertising and used to stage the CrashFix lure.Qilin#BackdoorMistic
Vendors
Products
Microsoft 365 Apps for EnterpriseIn reported cases the operator rotated through multiple Microsoft 365 tenants over an extended period to blunt reactive blocking and reached persistent access within minutes of the victim pasting a single PowerShellMicrosoft Teams[T1566.001 ] Phishing: Spearphishing Attachment – Social-engineering lures and Microsoft Teams pretexts were used to deliver commands (‘helpdesk and IT-support pretexts delivered through external Microsoft Teams chats’).Microsoft Windows[T1083 ] File and Directory Discovery – The operators enumerated files and staged data while using Windows tooling for host assessment (‘gathering host and service inventories’).Node.jsOther ModeloRAT and Node.js activity that is likely linked to the same actors was seen at some other organizations from February 2026, but Mistic was not deployed in those incidents.WordPressIts malicious traffic distribution system is mainly built on compromised WordPress sites, which it uses to deliver an evolving series of social-engineering lures that trick users into executing attacker-supplied
Tools
certutil[T1218 ] System Binary Proxy Execution – Legitimate signed binaries such as pythonw.exe, node.exe, and certutil were abused to run attacker code (‘abused as the carrier and runtime’).curl[T1105 ] Ingress Tool Transfer – Attackers used tools like curl and PowerShell to download payloads and components (‘download payloads’).finger.exeFinger.exe: Living-off-the-land Windows binary abused from late 2025 to retrieve obfuscated payloads.Net (net.exe)Net (net.exe): Microsoft tool that can be used to manage network resources.Node.exe[T1218 ] System Binary Proxy Execution – Legitimate signed binaries such as pythonw.exe, node.exe, and certutil were abused to run attacker code (‘abused as the carrier and runtime’).PowerShellThe broader tradecraft includes ClickFix, FileFix, CrashFix, PowerShell chains, RC4-encrypted C2, persistence mechanisms, and extensive reconnaissance.reg.exeReg.exe: Windows command line tool that can be used to edit the registry of local or remote computers.WinPython (WPy64-31401)WinPython (WPy64-31401): A legitimate, signed portable Python distribution abused as the carrier and runtime for ModeloRAT.wmicWMIC (Windows Management Instrumentation): Microsoft command-line tool that can be used to execute commands on remote computers.
Industries
EducationThe campaign relies on DLL sideloading, in-memory execution, and opportunistic targeting across sectors such as insurance, education, IT, and professional services.InsuranceThe campaign relies on DLL sideloading, in-memory execution, and opportunistic targeting across sectors such as insurance, education, IT, and professional services.ITBackdoor.Mistic is a stealthy new backdoor used in cybercrime intrusions since April 2026, and it has appeared alongside ModeloRAT in activity linked to Woodgnat.Professional ServicesThe campaign relies on DLL sideloading, in-memory execution, and opportunistic targeting across sectors such as insurance, education, IT, and professional services.