Stealthy new backdoor surfaces in attacks on multiple sectors

Symantec observed a new backdoor named Mistic (also documented as MLTBackdoor) deployed since April 2026 by the financially motivated initial access broker Woodgnat across insurance, education, IT, and professional services; Mistic is stealthy (in-memory execution and a kill switch), was side‑loaded through legitimate binaries (MpExtMs.exe/EndpointDlp.dll), was used alongside ModeloRAT and living‑off‑the‑land tools, and Symantec published associated IoCs.