Mistic Backdoor Linked to Ransomware Access Broker KongTuke
Summary
Symantec and Zscaler report that Mistic, also tracked as MTLBackdoor, has been used in financially motivated intrusions. The stealthy backdoor is linked to KongTuke/Woodgnat and supports persistence, in-memory execution, and Beacon Object Files.
Key points
- Mistic has been observed in financially motivated intrusions targeting insurance, education, IT, and professional services organizations.
- Symantec links the backdoor to KongTuke/Woodgnat, an initial access broker associated with ransomware groups.
- One observed infection chain used a legitimate executable to sideload a malicious DLL that loads Mistic.
- A separate .NET DLL displayed a fake login screen to steal credentials.
- Mistic supports file operations, C2 commands, in-memory code execution, and self-deletion.
- Zscaler reports that MTLBackdoor was delivered in a multi-stage ClickFix infection chain and can load Beacon Object Files.
Article Details
- Event Type
- A newly observed backdoor, Mistic, was used in financially motivated intrusions; researchers link it to the initial access broker KongTuke/Woodgnat.
- Impact
- Mistic supports stealthy persistence, command-and-control, in-memory code execution, and file operations. A separate DLL displayed a fake login screen to steal credentials. Attacks targeted organizations in insurance, education, IT, and professional services. The article does not report the number of victims or confirmed resulting losses.
MITRE ATT&CK
Threat Actors
8baseNamed as a ransomware group to which KongTuke reportedly sells compromised-network access; the article does not specifically link 8Base to the Mistic intrusions.AkiraNamed as a ransomware group to which KongTuke reportedly sells compromised-network access; the article does not specifically link Akira to the Mistic intrusions.Black BastaNamed as a ransomware group to which KongTuke reportedly sells compromised-network access; the article does not specifically link Black Basta to the Mistic intrusions.InterlockNamed as a ransomware group to which KongTuke reportedly sells compromised-network access; the article does not specifically link Interlock to the Mistic intrusions.QilinNamed as a ransomware group to which KongTuke reportedly sells compromised-network access; the article does not specifically link Qilin to the Mistic intrusions.RhysidaNamed as a ransomware group to which KongTuke reportedly sells compromised-network access; the article does not specifically link Rhysida to the Mistic intrusions.WoodgnatThe article links KongTuke to Mistic and describes it as an initial access broker that compromises corporate networks and sells access to ransomware groups. The link to Mistic is presented as researchers’ belief.
Malware
D3F@ck Loaderthe fake NexShield browser extension, the encrypted GateKeeper .NET payload, and the MintsLoader and D3F@ck Loader malware loaders to deliver additional payloads.MintsLoaderpayloads, the fake NexShield browser extension, the encrypted GateKeeper .NET payload, and the MintsLoader and D3F@ck Loader malware loaders to deliver additional payloads.MisticMistic is a stealthy new backdoor used in financially motivated attacks against organizations in insurance, education, IT, and professional services, with evidence linking it to the KongTuke/Woodgnat initial accessModeloRAT#MisticMTLBackdoor#Mistic
Products
Industries
Educationis a stealthy new backdoor used in financially motivated attacks against organizations in insurance, education, IT, and professional services, with evidence linking it to the KongTuke/Woodgnat initial access broker.InsuranceMistic is a stealthy new backdoor used in financially motivated attacks against organizations in insurance, education, IT, and professional services, with evidence linking it to the KongTuke/Woodgnat initial accessITstealthy new backdoor used in financially motivated attacks against organizations in insurance, education, IT, and professional services, with evidence linking it to the KongTuke/Woodgnat initial access broker.Professional Servicesused in financially motivated attacks against organizations in insurance, education, IT, and professional services, with evidence linking it to the KongTuke/Woodgnat initial access broker.