A new cybersecurity threat has emerged in the form of a stealthy backdoor malware known as Mistic, which has been linked to financially motivated attacks targeting various sectors, including insurance, education, IT, and professional services. Researchers at cybersecurity firm Symantec have noted that Mistic has been active since April 2024, indicating a concerning trend in the landscape of cyber threats.
Mistic is believed to be associated with KongTuke/Woodgnat, an initial access broker that has been operational since at least 2024. This group specializes in breaching corporate networks and selling access to ransomware gangs like Qilin, Interlock, Rhysida, and others. Such affiliations highlight the increasingly interconnected nature of cybercriminals, where various groups collaborate to maximize their impact.
In the in-depth investigations conducted by Symantec, they found Mistic used in several intrusions, including one notable case where it was deployed shortly after another backdoor, ModeloRAT, was delivered via Microsoft Teams social engineering attacks. Such tactics showcase the evolving strategies employed by cybercriminals to exploit human vulnerabilities and gain access to sensitive information and systems.
Mistic Attack Chain: An Inside Look
The Mistic infection path begins with the execution of a legitimate-looking executable named MpExtMs.exe. This benign-looking process is manipulated to side-load a malicious Dynamic Link Library (DLL) called version.dll, which serves as the loader for Mistic (specifically, EndpointDlp.dll). The choice of a filename that resembles legitimate Microsoft endpoint tools is a clever tactic to help the malware camouflage itself among trusted software on the host machine.
In addition to the primary DLL, Mistic also loads another .NET DLL designed to create a fake login screen. This deceptive interface is specifically designed to harvest user credentials, underscoring the extensive planning that goes into these sophisticated attacks.
Once Mistic is operational, it establishes communication with its command-and-control (C2) infrastructure, which allows attackers to send a range of commands. The capabilities of Mistic are extensive and alarming; they include:
- Uploading, downloading, moving, renaming, and deleting files, as well as creating folders.
- Modifying how frequently it checks for new commands from the C2 server.
- Executing commands directly in memory, eliminating the need to write anything to disk.
- Self-termination and file deletion from the host upon command.
This functionality indicates a design focus on maintaining a low-profile presence within compromised networks, emphasizing stealth and persistence. According to Symantec, the ability to run commands directly in memory and incorporate a self-destruct feature align with the goals of operators seeking long-term, discreet access.
While specific infection vectors were not detailed by Symantec, the KongTuke group is known to employ various methods, including the ClickFix platform and the FileFix and CrashFix variants to deliver the ModeloRAT malware. Zscaler, another cybersecurity company, reported similar findings, referring to Mistic as MTLBackdoor and observing its delivery within a multi-stage ClickFix infection chain in May.
@Zscaler researchers pointed out that a standout feature of MTLBackdoor is its capability to load Beacon Object Files (BOFs). These are compact programs written in C that can operate directly within the memory of a C2 process, allowing them to evade detection by traditional security measures—a tactic often employed in advanced post-exploitation activities.
Both Zscaler and Symantec not only confirm that Mistic is a custom tool increasingly used in ransomware attacks but also highlight the backdoor’s connections to broader ransomware ecosystems. KongTuke has been known to utilize a range of additional tools, including legitimate software like WinPython and Node.js for executing malicious codes, and various malware loaders designed to obscure their activities further.
Comprehensive reports from both firms provide crucial indicators of compromise related to Mistic and its functionality, offering security teams the intelligence needed to enhance their defenses against such sophisticated threats.
According to security metrics, 54% of successful attacks go unnoticed by teams, with only 14% triggering alerts. An insightful whitepaper from Picus reveals how breach and attack simulations can efficiently test SIEM and EDR rules, ensuring that threats do not slip by undetected.