Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs
Woodgnat hackers use Mistic RAT to broker network access for ransomware gangs.
A new remote access Trojan (RAT) called Backdoor.Mistic is being used by the Woodgnat hacking group to compromise corporate networks. These actors act as initial access brokers, selling entry points to ransomware gangs like Qilin and Black Basta. The group employs social engineering tactics, including fake technical alerts via hijacked websites and deceptive Microsoft Teams messages, to trick employees into running malicious commands.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Broadcom?
Get an email when a new story names Broadcom, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Woodgnat group exploits human trust rather than technical vulnerabilities, using fake Microsoft Teams messages and hijacked websites to trick employees into executing malicious commands that install the Mistic RAT. This establishes persistent access that is then monetized by selling entry points to ransomware gangs like Qilin and Black Basta, amplifying the downstream damage far beyond the initial compromise. The attack highlights how social engineering remains one of the most effective and underestimated vectors, particularly when employees are not trained to scrutinize unexpected technical alerts or unsolicited IT support interactions. Because the entry point is human behavior rather than an unpatched system, traditional perimeter defenses alone are insufficient to stop this threat.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Backdoor.Mistic
- malware — MLTBackdoor
- malware — ModeloRAT