[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwl5JOHHL1gacFVFb4lnAqvvBDV2Ull_JO5QNELlnnzY":3},{"article":4,"iocs":57,"watch_terms":67,"solutions":68,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"2019b585-9263-41fe-9f9f-10192d66d301","Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs","woodgnat-hackers-use-mistic-rat-to-broker-access-for-ransomware-gangs-9bf4a1","Woodgnat Hackers use Backdoor.Mistic, a stealthy RAT, to let brokers compromise networks and sell entry points to ransomware groups, putting firms at risk.","A new remote access Trojan (RAT) called Backdoor.Mistic is being used by the Woodgnat hacking group to compromise corporate networks. These actors act as initial access brokers, selling entry points to ransomware gangs like Qilin and Black Basta. The group employs social engineering tactics, including fake technical alerts via hijacked websites and deceptive Microsoft Teams messages, to trick employees into running malicious commands.","Woodgnat hackers use Mistic RAT to broker network access for ransomware gangs.","https:\u002F\u002Fhackread.com\u002Fwoodgnat-hackers-mistic-rat-access-ransomware-gangs\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fwoodgnat-hackers-mistic-rat-access-ransomware-gangs.jpg","2026-06-26T19:38:14+00:00","2026-06-26T20:00:09.369592+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Woodgnat hackers","threat_actor",{"name":21,"type":19},"KongTuke",{"name":23,"type":24},"Zscaler","vendor",{"name":26,"type":24},"Broadcom",{"name":28,"type":24},"Symantec",{"name":30,"type":24},"Carbon Black","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[58,61,64],{"type":51,"value":59,"context":60},"Backdoor.Mistic","Remote Access Trojan used by Woodgnat hackers",{"type":51,"value":62,"context":63},"MLTBackdoor","Alternative tracking name for Backdoor.Mistic by Zscaler",{"type":51,"value":65,"context":66},"ModeloRAT","Another tool deployed by Woodgnat hackers",[26,23,28],{"controls":69,"vendors":153},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":100,"name":101,"problem":102,"products":103},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":129,"name":130,"problem":131,"products":132},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[133,140,147],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":129,"product_name":137,"url":138,"description":139},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":141,"product_name":144,"url":145,"description":146},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":148,"product_name":149,"url":151,"description":152},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[154],{"slug":155,"name":23,"logo_path":156,"roles":157},"zscaler","\u002Fvendor-logos\u002Fzscaler.png",[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":175},"woodgnat-uses-mistic-rat-to-sell-corporate-access-to-ransomware-groups","Woodgnat Uses Mistic RAT to Sell Corporate Access to Ransomware Groups","The Woodgnat group exploits human trust rather than technical vulnerabilities, using fake Microsoft Teams messages and hijacked websites to trick employees into executing malicious commands that install the Mistic RAT. This establishes persistent access that is then monetized by selling entry points to ransomware gangs like Qilin and Black Basta, amplifying the downstream damage far beyond the initial compromise. The attack highlights how social engineering remains one of the most effective and underestimated vectors, particularly when employees are not trained to scrutinize unexpected technical alerts or unsolicited IT support interactions. Because the entry point is human behavior rather than an unpatched system, traditional perimeter defenses alone are insufficient to stop this threat.",[164,165,166,167,168,169,170,171,172,173,174],"CIS Control 5 – Account Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 IR-6 – Incident Reporting","MITRE ATT&CK T1566 – Phishing (Social Engineering)","MITRE ATT&CK T1219 – Remote Access Software","GDPR Article 32 – Security of Processing","ITIL Service Operation – Incident Management",{}]