New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
New Mistic backdoor linked to KongTuke and ModeloRAT in financially motivated attacks.
A new stealthy backdoor named Mistic, also tracked as MLTBackdoor, has been deployed in financially motivated attacks since April 2026. It is linked to the initial access broker KongTuke and is dropped alongside ModeloRAT, a Python RAT. The attacks target sectors including insurance, education, IT, and professional services, with Mistic utilizing DLL side-loading and in-memory execution for stealth.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Mistic/MLTBackdoor campaign exploits user interaction through ClickFix-style social engineering lures, tricking victims into executing malicious payloads without recognizing the threat. Once executed, the malware leverages DLL side-loading — abusing legitimate, trusted applications to load malicious code — combined with in-memory execution to avoid file-based detection by traditional antivirus tools. The involvement of an initial access broker (KongTuke) highlights that attackers are professionalizing their operations, lowering the barrier for financially motivated threat actors to gain footholds in targeted organizations. Sectors like insurance, education, and IT are attractive targets due to the high value of their data and the financial transactions they facilitate. Without robust behavioral monitoring and application controls, these stealthy techniques can persist undetected for extended periods.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Mistic
- malware — MLTBackdoor
- malware — ModeloRAT
- mitre_attack — T1059
- mitre_attack — T1071.004
- mitre_attack — T1574.002
- mitre_attack — T1055