Mistic: the quiet backdoor feeding ransomware crews

A new backdoor called Mistic has been turning up inside insurance firms, schools, IT shops and professional services outfits since April. Symantec reckon they know who is steering it: KongTuke, also tracked as Woodgnat, an initial access broker that has spent the last two years breaking into corporate networks and quietly handing the keys to ransomware crews including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta.

The craft is what makes Mistic interesting. It arrives by side-loading a malicious DLL through the legitimate MpExtMs.exe, with the payload sitting on disk as EndpointDlp.dll. That filename is the sort of thing a tired admin would scroll straight past, assuming it belongs to Microsoft. A second .NET component throws up a fake login window to harvest credentials while the backdoor settles in behind it.

In memory, on command

Once it's running, very little touches disk. Payloads execute in memory and there is a built-in kill switch that lets the operator wipe the malware whenever they please. Forensics teams arriving after the fact get to admire an empty room.

Zscaler, which tracks the same tool as MTLBackdoor, watched it being dropped in May through a ClickFix infection chain. ClickFix is the social engineering trick where a victim is talked into pasting a malicious command into the Run box, usually under the guise of fixing a broken page or verifying they're human. It works far more often than it should.

The capability the researchers flagged hardest was Mistic's ability to load Beacon Object Files, the small in-memory C programs that red teamers run inside Cobalt Strike for post-exploitation tasks. In practical terms, the operator can bolt on new tricks, credential dumping, lateral movement, reconnaissance, without ever writing a new tool to disk.

A growing toolkit

KongTuke is not short of options. The group has been seen pairing Mistic with:

• ModeloRAT, delivered through Microsoft Teams social engineering
• A fake browser extension called NexShield
• The MintsLoader and D3F@ck loaders
• Legitimate runtimes like WinPython and Node.js, used to execute malicious code under cover of trusted binaries

That last category is worth pausing on. Running attacker code through Node.js or a Python interpreter that's already trusted on the machine sidesteps a lot of the controls organisations rely on to spot something dodgy. The binary is signed. The behaviour is, on paper, normal. The malice lives in the script it's executing.

The shape of the access economy

The wider story here is what KongTuke represents. Initial access brokers used to be middlemen, buying credentials from infostealer logs and reselling them. The brokers worth watching now are writing their own custom malware, running their own social engineering campaigns and building toolchains that rival the ransomware groups they sell to. Qilin and Akira don't have to do the breaking-in any more. They subscribe.

And the entry point, for all the technical sophistication that follows, is almost always the same. Somebody is convinced to click, paste or run something they shouldn't. The DLL side-loading, the in-memory execution, the BOF support, all of it sits downstream of a human deciding the prompt in front of them looks legitimate enough to act on.