Mistic Backdoor Enables Stealthy In – Memory Attacks to Support Ransomware Operations
Researchers have identified a new stealthy backdoor called Mistic (also tracked as MLTBackdoor by Zscaler) used in financially motivated attacks targeting organizations across the insurance, education, IT, and professional services sectors since April 2026. The malware is attributed to Woodgnat (aka KongTuke), an initial access broker that establishes persistent access before selling compromised environments to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
The attack commonly begins through ClickFix-style social engineering (and related FileFix / CrashFix variants), where victims are tricked into pasting and executing malicious PowerShell commands. Attackers also use helpdesk/IT-support lures delivered through external Microsoft Teams chats, and DNS-based payload retrieval techniques. Once executed, Mistic leverages DLL side-loading by abusing the legitimate Microsoft binary MpExtMs.exe , using a version.dll loader to load the EndpointDlp.dll payload, with names mimicking Microsoft security tooling to evade detection and blend into normal system activity.
Unlike traditional malware, Mistic executes payloads entirely in memory, leaving little to no evidence on disk. It supports remote file management (upload/download, move, rename, delete), directory creation, configurable command polling, in-memory execution of additional payloads, dynamic capability expansion, credential theft via a loaded .NET DLL displaying fake login screens, and a self-deletion mechanism to remove traces after execution. The actor maintains persistence via Run-key entries masquerading as AnyDesk/Splashtop, startup shortcuts, VBScript launchers, and scheduled tasks, and uses living-off-the-land tools (PowerShell, certutil, WMIC, net.exe, reg.exe, curl) for reconnaissance.
Researchers said the malware's stealth capabilities and modular design enable attackers to maintain long-term access, perform lateral movement, and prepare compromised environments for ransomware deployment. The activity reflects a growing trend where initial access brokers develop custom malware to provide ransomware operators with reliable and covert access to targeted networks.
Attack Surface
Endpoint, Endpoint OS
Tactics
Initial Access, Persistence, Privilege Escalation, Defense Evasion, Exfiltration
Techniques
- T1190 – Exploit Public-Facing Application
- T1105 – In-Memory Execution
- T1055 – Password Attacks
- T1036 – Masquerading
- T1021 – Remote Services
SuperPRO's Threat Countermeasures Procedures
- Implement strict application control and monitoring to detect unauthorized DLL side loading attempts on trusted system binaries
- Configure endpoint detection and response tools to actively scan system memory for anomalous code execution and fileless payloads
- Restrict user permissions and keep an eye on command-line tools and scripts like PowerShell, certutil, and WMIC, especially when they're triggered by ClickFix or FileFix style lures.
- Deploy advanced network filtering to block suspicious DNS queries used for malware staging or signaling channels
- Establish strict verification protocols for internal communications platforms to prevent impersonation via fake support accounts
- Conduct regular threat hunting assessments focused on detecting persistent but low visibility access within the network