New Mistic Backdoor Linked to Kong Tuke in Click Fix and ModeloRAT Campaigns
Summary: A new backdoor called Mistic, also tracked as MLTBackdoor, has been deployed since April 2026 against organizations in insurance, education, IT, and professional services, linked by Symantec and Carbon Black to the initial access broker KongTuke and dropped alongside the Python remote access trojan ModeloRAT. The backdoor runs payloads in memory with no file written to disk, includes a kill switch that lets it delete itself, and uses DLL side-loading through the trusted Microsoft tool MpExtMs.exe to blend in.
Key Takeaway: KongTuke casts a wide net and then decides which organizations' access to sell, and ModeloRAT has already been observed in attacks that deployed Qilin ransomware - so an intrusion that looks like commodity noise may be an access broker sizing up your network for a ransomware affiliate.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026