Woodgnat Uses ClickFix, FileFix, and CrashFix Lures to Deliver Remote Access Malware

The report describes the discovery of the Mistic backdoor linked to Woodgnat (KongTuke), an initial-access broker that establishes persistent remote access and sells network footholds to ransomware affiliates. It outlines the group's operational methods—compromised WordPress sites, social-engineering via Microsoft Teams, DLL sideloading, in-memory payloads, a .NET credential stealer, and ModeloRAT usage—and provides IoCs (file hashes) and persistence/evasion techniques.